Senior DevSecOps & Supply-Chain Security Consultant

Zappsec Inc.; Tewksbury (MA); On-site; USD 150,000 - 230,000; Full time

Job summary

Zappsec Inc. is seeking a DevSecOps & Supply Chain Security Consultant to advise on secure SDLC, SBOM governance, pipeline controls and release governance.

The role demands extensive experience with SBOM frameworks, SCA tooling, and audit-ready reporting to support regulatory compliance and risk reduction. The consultant will validate traceability, build provenance, artifact signing and tamper resistance across CI/CD and IaC environments, delivering actionable remediation guidance and executive

Qualifications

• Strong DevSecOps and secure software delivery practices.
• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling.
• Familiarity with CI/CD security controls and artifact integrity validation.
• Experience with vulnerability management and dependency governance programs.
• Understanding of lifecycle security, auditability, and compliance evidence requirements.
• Experience with secrets management and secure release governance.
• SBOM analysis (CycloneDX, SPDX, VEX/CSAF).
• Artifact signing, verification and tamper testing.
• Container, registry, build-agent and CI/CD runner security.
• Infrastructure-as-Code and pipeline-as-code security; policy-as-code.

Responsibilities

• Assess software supply chain security, SDLC maturity, SBOM governance and CI/CD controls.
• Review SDLC processes, tooling, and secure development practices.
• Assess software supply chain security, including SCA, SBOM accuracy and governance.
• Evaluate CI/CD pipeline security, artifact integrity and secure release controls.
• Review secrets management across development, build, deployment and operations.
• Assess logging, auditability and security event traceability controls.
• Evaluate vulnerability management, remediation tracking and patch governance.
• Support lifecycle security assessment, evidence mapping and traceability.
• Contribute to assessment reporting and remediation guidance.
• Produce audit-ready findings and executive-ready recommendations.

Skills

DevSecOps

Secure software delivery

SBOM frameworks

SCA tooling

CI/CD security

Vulnerability management

Secrets management

Compliance evidence

CRA/regulatory assessments

SBOM analysis (CycloneDX, SPDX)

Artifact signing & tamper testing

Audit trail & governance

Security gates & release governance

Tools

Syft

Grype

Trivy

Gitleaks

Dependency-Track

OpenSSL

Cosign

Sigstore

GitHub Actions

GitLab CI

Jenkins

Azure DevOps

Job description

Zappsec Inc. is seeking a DevSecOps & Supply Chain Security Consultant to advise on secure SDLC, SBOM governance, pipeline controls and release governance.

The role demands extensive experience with SBOM frameworks, SCA tooling, and audit-ready reporting to support regulatory compliance and risk reduction. The consultant will validate traceability, build provenance, artifact signing and tamper resistance across CI/CD and IaC environments, delivering actionable remediation guidance and executive