Senior DevSecOps Engineer: Secure Software Supply Chain

System One; Knoxville (TN); Hybrid; USD 140,000 - 170,000; Full time

Job summary

System One is seeking a Senior DevSecOps Engineer to strengthen software supply chain security across multiple U.S. locations in a hybrid, direct-hire role. You will implement policy governance, SBOM workflows, and secure CI/CD practices with tools like Sonatype, Nexus, and Sigstore.

Requirements include 5+ years in DevSecOps or related fields, strong AWS exposure, and experience with SLSA and OSS policies. Bachelor's degree in CS or related field required.

Qualifications

• 5+ years in DevSecOps, Platform Engineering, or Software Supply Chain Engineering.
• Hands on experience with Sonatype Lifecycle (IQ Server) and Nexus Repository, or similar tools like jFrog.
• Experience building and maintaining automated Open Source Software evaluation policies and workflows.
• Familiarity with artifact signing technologies such as Sigstore/Cosign, GPG, or Notary.
• Experience with SLSA provenance, in toto attestations, or similar frameworks.
• Background generating SBOMs using CycloneDX, SPDX, or Syft.
• CI/CD experience, ideally with GitLab (GitHub Actions also welcome).
• Strong AWS skills across IAM, ECS/EKS, EC2, S3, Lambda, Step Functions, and CloudWatch.
• Experience integrating security tooling directly into CI/CD pipelines.
• Solid scripting ability in Python, Bash, or Go.
• Experience maintaining enterprise open source platforms.
• Familiarity with OCI registries and package ecosystems (Maven, npm, PyPI, NuGet).
• Knowledge of NIST SSDF, Executive Order 14028, and Secure by Design principles.
• Educational Requirement: Bachelor's degree in Computer Science, Information Systems, or a related field.

Responsibilities

• Enhance artifact management, policy governance, and open source lifecycle processes using tools like Sonatype and Nexus Repository.
• Build and automate software approval workflows, quarantine/waiver processes, and repository proxy strategies across supported ecosystems.
• Drive dependency upgrades and vulnerability remediation efforts.
• Support onboarding of emerging ecosystems including AI/ML frameworks.
• Build reporting and metrics to track software supply chain health, policy compliance, and repository utilization.
• Enable CI/CD artifact signing and verification.
• Implement SLSA build provenance and attestations.
• Integrate SBOM generation into build and deployment pipelines.
• Work closely with security and development teams to improve software supply chain visibility and integrity.

Skills

DevSecOps

Platform engineering

Software supply chain

OSS evaluation policies

Artifact signing

SLSA provenance

SBOM generation

CI/CD (GitLab)

AWS

Security tooling in CI/CD

Scripting (Python/Bash/Go)

Open source platforms

OCI registries & package ecosystems

Secure by design principles

GitHub Actions

Education

Bachelor's degree

Tools

Sonatype Lifecycle

Nexus Repository

JFrog

Sigstore/Cosign

GPG

Notary

CycloneDX

SPDX

Syft

GitLab

GitHub Actions

OCI registries

Maven

npm

PyPI

NuGet

Job description

System One is seeking a Senior DevSecOps Engineer to strengthen software supply chain security across multiple U.S. locations in a hybrid, direct-hire role. You will implement policy governance, SBOM workflows, and secure CI/CD practices with tools like Sonatype, Nexus, and Sigstore.

Requirements include 5+ years in DevSecOps or related fields, strong AWS exposure, and experience with SLSA and OSS policies. Bachelor's degree in CS or related field required.