DevSecOps Architect – Software Supply Chain Security

SecureBlu by New Era Technology is looking for a hands-on DevSecOps Architect specializing in Software Supply Chain Security to help secure software build and release pipelines for our client, Commvault.

The ideal candidate will have strong experience securing CI/CD pipelines, managing Software Bills of Materials (SBOMs), implementing artifact signing and provenance verification, and securing Kubernetes environments. This role focuses on hands-on implementation of security controls across the software development lifecycle.

Key Responsibilities

• Design and implement software supply chain security controls across build and release pipelines.

• Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation.

• Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX.

• Integrate dependency scanning and vulnerability management into CI/CD pipelines.

• Implement artifact signing and verification using Sigstore, Cosign, or in-toto.

• Develop and enforce security-as-code and policy-as-code controls using tools such as Open Policy Agent (OPA), Kyverno, or Conftest.

• Secure Kubernetes-based build and deployment environments.

• Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows.

• Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants.

• Align security practices with SLSA, NIST SSDF, and NIST SP 800-218.

• Develop security documentation, reference architectures, runbooks, and audit evidence.

• Collaborate with security, engineering, platform, and compliance teams.

Required Qualifications

• 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security.

• Strong hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration.

• Experience generating and managing SBOMs using SPDX or CycloneDX.

• Knowledge of SLSA, NIST SSDF, and NIST SP 800-218.

• Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto.

• Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening.

• Experience with policy-as-code tools such as OPA, Kyverno, or Conftest.

• Understanding of threat modeling methodologies such as STRIDE or attack trees.

• Scripting proficiency in Python, Bash, or Go.

• Familiarity with Docker, OCI images, container registries, and container security.

Preferred Qualifications

• Experience with cloud platforms such as AWS, Azure, or Google Cloud.

• Familiarity with vulnerability management tools such as Snyk or Dependency-Track.

• Experience working in enterprise or regulated software environments.

• Previous consulting or contract experience supporting distributed engineering teams.

Work Arrangement

• Remote position.

• Regular overlap with US business hours is required for cross-team collaboration.

• No routine travel is identified.

Education: Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent practical experience.

Interested candidates are encouraged to apply with their updated resume.