Senior OSS Security Engineer: Secure Software Supply Chain

Truist; Atlanta (GA); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401k plan

Vacation & holidays

Job summary

Truist is seeking an Open Source Software and Software Supply Chain Security Senior Engineer to own the practical execution of OSS security across governance, engineering workflows, tooling, automation, and risk reduction. You will lead security programs while delivering hands-on security improvements within enterprise pipelines and release processes.

You will partner with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure OSS components and pipelines are

Qualifications

• Bachelor's degree or equivalent education, training, and work-related experience.
• Minimum 7 years of experience in security engineering or related cybersecurity roles.
• Strong knowledge of threat modelling, security testing, and penetration testing.

Responsibilities

• Governance, standards, and control requirements for approved OSS usage and SBOM generation.
• Secure OSS lifecycle management including intake, approval, tracking, and version management.
• Design and implement automated security gates for curated OSS usage and dependency scanning.
• Identify and reduce risks related to vulnerable dependencies and malicious packages.
• Establish controls for trusted package sources, provenance, and build integrity.
• Develop tooling, dashboards, and metrics to measure OSS risk posture and remediation velocity.
• Create playbooks and guidance to help engineering teams make secure OSS decisions.

Skills

Security engineering

Threat modelling

Penetration testing

CI/CD pipelines

Automation

Education

Bachelor's degree or equivalent

Tools

CI/CD platforms

Source code management

Package managers

Build systems

Artifact repositories

Job description

Truist is seeking an Open Source Software and Software Supply Chain Security Senior Engineer to own the practical execution of OSS security across governance, engineering workflows, tooling, automation, and risk reduction. You will lead security programs while delivering hands-on security improvements within enterprise pipelines and release processes.

You will partner with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure OSS components and pipelines are