DevSecOps Architect – Software Supply Chain Security

This is a fully remote position, open to applicants in United States.

📋 Description

• Design and implement security controls for software supply chain across build and release pipelines.

• Secure GitHub and GitLab environments by enforcing branch protection, signed commits, access controls, and provenance attestation.

• Execute SBOM generation, validation, and distribution utilizing Syft, CycloneDX, or SPDX.

• Integrate dependency scanning and vulnerability management within CI/CD pipelines.

• Implement artifact signing and verification processes using tools such as Sigstore, Cosign, or in-toto.

• Develop and apply security-as-code and policy-as-code controls through OPA, Kyverno, or Conftest.

• Ensure the security of Kubernetes-based build and deployment environments.

• Perform threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows.

• Evaluate risks linked to open-source dependencies, AI-generated code, and AI coding assistants.

• Align security practices with SLSA, NIST SSDF, and NIST SP 800-218.

• Create security documentation, reference architectures, runbooks, and audit evidence.

• Collaborate with teams across security, engineering, platform, and compliance domains.

⛳️ Requirements

• 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct responsibility for CI/CD security.

• Strong hands-on experience with GitHub Actions, GitLab pipelines, and managing enterprise-scale repositories.

• Proficient in generating and managing SBOMs with SPDX or CycloneDX.

• Familiarity with SLSA, NIST SSDF, and NIST SP 800-218 standards.

• Experience with artifact signing, provenance, and verification tools like Sigstore, Cosign, or in-toto.

• Hands-on experience in Kubernetes security, including admission control, network policies, and workload hardening.

• Knowledge of policy-as-code tools such as OPA, Kyverno, or Conftest.

• Understanding of threat modeling methodologies, including STRIDE or attack trees.

• Proficiency in scripting languages such as Python, Bash, or Go.

• Familiarity with Docker, OCI images, container registries, and container security practices.

• Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field, or equivalent practical experience.

• Regular availability during US business hours is necessary.

🏝️ Benefits

• Competitive benefits package.

• Ongoing training opportunities.

• Personal and professional development prospects.

• A team-oriented, collaborative, and inclusive culture.

• No routine travel is required.