Senior DevSecOps Engineer: Software Supply Chain & CI/CD

System One, Inc.; Lafayette (LA); Presencial; USD 140 000 - 180 000; Tempo integral

Resumo da oferta

System One in Lafayette, LA (with sites in Knoxville, TN; Birmingham, AL; Columbia, SC) seeks a Senior DevSecOps Engineer to strengthen software supply chain security across enterprise environments.

You will drive artifact management, SBOM generation, OSS governance, and CI/CD security, integrating signing, provenance, and policy automation with tools like Nexus, Sonatype, and JFrog.

Qualificações

• 5+ years in DevSecOps, Platform Engineering or Software Supply Chain Engineering.
• Hands-on with lifecycle tooling (Sonatype IQ Server, Nexus, JFrog).
• Experience building open-source evaluation policies and workflows.

Responsabilidades

• Enhance artifact management, policy governance, and open-source lifecycle processes.
• Build and automate software approval workflows including quarantine and waivers.
• Develop repository proxy strategies across ecosystems.

Conhecimentos

DevSecOps

Platform Engineering

Software Supply Chain

OSS evaluation policies

CI/CD

AWS

Python

Bash

Go

GitLab

GitHub Actions

Formação académica

Bachelor’s degree in Computer Science or Information Systems

Ferramentas

Sonatype Lifecycle / IQ Server

Nexus Repository

JFrog

Sigstore

Cosign

GPG

Notary

SLSA provenance

in-toto attestations

CycloneDX

SPDX

Syft

GitLab CI/CD

GitHub Actions

Maven

npm

PyPI

NuGet

OCI registries

Amazon ECS/EKS

Amazon S3/Lambda/CloudWatch

Descrição da oferta de emprego

Senior DevSecOps Engineer
Permanent Full-Time
Lafayette, LA | Knoxville, TN | Birmingham, AL | Columbia SC

Position Description
This role focuses on improving software supply chain security, artifact management, open-source governance, CI/CD security, SBOM generation, artifact signing, and software provenance across enterprise environments.
Key Responsibilities

• Enhance artifact management, policy governance, and open-source lifecycle processes using tools such as Sonatype Lifecycle (IQ Server), Nexus Repository, or JFrog.
• Build and automate software approval workflows, including quarantine and waiver processes.
• Develop and maintain repository proxy strategies across supported software ecosystems.
• Drive dependency upgrades and vulnerability remediation initiatives.
• Support onboarding of emerging ecosystems, including AI/ML frameworks.
• Build reporting and metrics for:
  • Software supply chain health
  • Policy compliance
  • Repository utilization
• Enable CI/CD artifact signing and verification.
• Implement SLSA build provenance and attestations.
• Integrate SBOM generation into build and deployment pipelines.
• Partner with security and development teams to improve software supply chain visibility, integrity, and security across the organization.
• Help build secure and trustworthy software delivery pipelines at enterprise scale.

Required Qualifications

• 5+ years of experience in:
  • DevSecOps
  • Platform Engineering
  • Software Supply Chain Engineering
• Hands-on experience with:
  • Sonatype Lifecycle / IQ Server
  • Nexus Repository
  • Or similar tools such as JFrog
• Experience building and maintaining automated Open Source Software evaluation policies and workflows.
• Experience with artifact signing technologies such as:
  • Sigstore
  • Cosign
  • GPG
  • Notary
• Experience with:
  • SLSA provenance
  • in-toto attestations
  • Similar software supply chain frameworks
• Experience generating SBOMs using:
  • CycloneDX
  • SPDX
  • Syft
• Strong CI/CD experience, preferably:
  • GitLab
  • GitHub Actions also acceptable
• Strong AWS experience with:
  • IAM
  • ECS / EKS
  • EC2
  • S3
  • Lambda
  • Step Functions
  • CloudWatch
• Experience integrating security tooling directly into CI/CD pipelines.
• Strong scripting skills in:
  • Python
  • Bash
  • Go
• Experience maintaining enterprise open-source platforms.
• Familiarity with OCI registries and package ecosystems such as:
  • Maven
  • npm
  • PyPI
  • NuGet
• Knowledge of:
  • NIST SSDF
  • Executive Order 14028
  • Secure by Design principles

Educational Requirement
Bachelor’s degree in Computer Science, Information Systems, or a related field.