New Era Technology - DevSecOps Architect – Software Supply Chain Security
Requirements
• 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security. • Strong hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration. • Experience generating and managing SBOMs using SPDX or CycloneDX. • Knowledge of SLSA, NIST SSDF, and NIST SP 800-218. • Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto. • Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening. • Experience with policy-as-code tools such as OPA, Kyverno, or Conftest. • Understanding of threat modeling methodologies such as STRIDE or attack trees. • Scripting proficiency in Python, Bash, or Go. • Familiarity with Docker, OCI images, container registries, and container security. • Experience with cloud platforms such as AWS, Azure, or Google Cloud. • Familiarity with vulnerability management tools such as Snyk or Dependency-Track. • Experience working in enterprise or regulated software environments. • Previous consulting or contract experience supporting distributed engineering teams. • Work Arrangement
Responsibilities
• Design and implement software supply chain security controls across build and release pipelines. • Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation. • Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX. • Integrate dependency scanning and vulnerability management into CI/CD pipelines. • Implement artifact signing and verification using Sigstore, Cosign, or in-toto. • Develop and enforce security-as-code and policy-as-code controls using tools such as Open Policy Agent (OPA), Kyverno, or Conftest. • Secure Kubernetes-based build and deployment environments. • Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows. • Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants. • Align security practices with SLSA, NIST SSDF, and NIST SP 800-218. • Develop security documentation, reference architectures, runbooks, and audit evidence. • Collaborate with security, engineering, platform, and compliance teams.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT