Software Engineer – SBOM & Compliance

ThunderSoft; San Diego (CA); On-site; USD 85,000 - 110,000; Full time

Job summary

A technology company is seeking a Software Engineer with expertise in SBOM standards and software supply chain security. This role will focus on designing and implementing workflows for compliance with the EU Cyber Resilience Act. Candidates should have experience in embedded C/C++ environments and a strong understanding of DevSecOps practices. The position involves collaboration with engineering and security teams to ensure high-quality software delivery. Strong communication skills are essential.

Qualifications

• 2+ years of relevant software engineering experience.
• Strong knowledge of SBOM standards including SPDX and CycloneDX.
• Experience with EU Cyber Resilience Act compliance.

Responsibilities

• Design, develop, and validate embedded and cloud-edge software.
• Generate and maintain SBOMs ensuring compliance with CRA.
• Integrate SBOM generation and compliance checks into CI/CD pipelines.

Skills

SBOM standards and tooling

Embedded C/C++ proficiency

Software supply chain security

DevSecOps methodologies

Communication skills

Education

Bachelor’s degree or above in Engineering, Computer Science, Information Systems or related field

Tools

SPDX

CycloneDX

Syft

Snyk

Black Duck

Job description

We are seeking a Software Engineer with expertise in SBOM standards, software supply chain security, and cybersecurity compliance to support embedded and cloud-edge software development. This role focuses on designing, implementing, validating, and automating SBOM workflows to meet regulatory requirements such as the EU Cyber Resilience Act (CRA). The ideal candidate has hands-on experience in embedded C/C++ environments, DevSecOps practices, and cross-functional collaboration to ensure secure, compliant, and high-quality software delivery.

Responsibilities

• Design, develop, modify, and validate embedded and cloud-edge software, applications, and utility programs.
• Generate, validate, and maintain SBOMs using standards such as SPDX and CycloneDX, ensuring compliance with CRA requirements and machine-readable metadata.
• Integrate SBOM generation, vulnerability scanning, and compliance checks into CI/CD pipelines for continuous software supply chain security.
• Apply secure software development practices within embedded C/C++ environments, including build systems and toolchains.
• Perform software component analysis, provenance tracking, and vulnerability scanning using SCA tools (e.g., Snyk, Black Duck).
• Analyze software requirements and user needs to design efficient, compliant software solutions.
• Participate in design, coding of large features, unit testing, debugging, integration, and regression testing.
• Conduct code reviews, triage issues, and implement fixes to maintain high-quality standards.
• Collaborate with cross-functional teams including engineering, security, compliance, and product stakeholders.
• Create and maintain technical documentation covering architecture, workflows, and compliance artifacts.

Qualifications

• Bachelor’s degree or above in Engineering, Computer Science, Information Systems, or related field with 2+ years of relevant software engineering experience;
• Strong knowledge of SBOM standards and tooling, including SPDX, CycloneDX, and tools such as Syft, SPDX tools, and CycloneDX CLI.
• Experience implementing EU Cyber Resilience Act (CRA) compliance in embedded software environments.
• Proficiency in embedded C/C++, build systems, and secure software development practices.
• Experience with software supply chain security, including provenance, component analysis, and vulnerability scanning.
• Familiarity with DevOps/DevSecOps methodologies and CI/CD automation.
• Strong verbal and written communication skills with the ability to work effectively across teams.