Senior OSS Security Engineer: Software Supply Chain Lead

Socket.dev; Charlotte (NC); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

Benefits package

Paid time off

Job summary

Truist Financial Corporation seeks an Open Source Software Security Engineer to lead governance and security for OSS across the SDLC. You will implement automated gates, SBOM practices, and supply chain controls in collaboration with CI/CD and risk teams.

The role requires deep security expertise, threat modeling, and hands-on delivery to reduce software supply chain exposure and enable secure enterprise applications.

Qualifications

• The Open Source Software (OSS) Senior Security Engineer owns the practical execution of open source software security across governance, engineering workflows, tooling, automation, and risk reduction.
• Governance and standards for OSS usage, SBOM generation, secure package sourcing, and risk management.
• CI/CD preventative controls including automated security gates, scanning, license checks, and artifact validation.
• Software supply chain risk reduction and secure release practices across the SDLC.
• Threat response capabilities to rapidly identify and respond to OSS security threats and incidents.
• Tooling and automation support for software composition analysis, SBOM, and repository hygiene.
• Risk reporting and metrics to measure OSS posture and remediation velocity.
• Developer enablement through guidance, playbooks, and reusable patterns for secure OSS decisions.

Responsibilities

• Define policies, standards, and control requirements for approved OSS usage and dependency hygiene.
• Establish processes for OSS intake, tracking, ownership, version management, and remediation.
• Design automated security gates for curated OSS usage, dependency scanning, and artifact validation.
• Identify and reduce risks from vulnerable dependencies and malicious packages.
• Establish controls for trusted sources, provenance, build integrity, and signing.
• Set up threat response capabilities to detect OSS supply chain threats.
• Support tooling for SCA, SBOM, and developer workflows.
• Create risk reports and remediation metrics.
• Provide guidance for secure OSS decision making early in the lifecycle.

Skills

Security engineering

Threat modeling

SCA & SBOM

CI/CD security

Automation scripting

Education

Bachelor’s degree or equivalent in education/training

Advanced cybersecurity certifications (e.g., CISSP, CISM, CEH, GIAC)

Tools

CI/CD platforms

SBOM tooling

Vulnerability management tools

Job description

Truist Financial Corporation seeks an Open Source Software Security Engineer to lead governance and security for OSS across the SDLC. You will implement automated gates, SBOM practices, and supply chain controls in collaboration with CI/CD and risk teams.

The role requires deep security expertise, threat modeling, and hands-on delivery to reduce software supply chain exposure and enable secure enterprise applications.