Employer description & source details
Design and implement software supply chain security controls across build and release pipelines. Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation. Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX. Integrate dependency scanning and vulnerability management into CI/CD pipelines. Implement artifact signing and verification using Sigstore, Cosign, or in-toto. Develop and enforce security-as-code and policy-as-code controls using tools such as Open Policy Agent (OPA), Kyverno, or Conftest. Secure Kubernetes-based build and deployment environments. Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows. Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants. Align security practices with SLSA, NIST SSDF, and NIST SP 800-218. Develop security documentation, reference architectures, runbooks, and audit evidence. Collaborate with security, engineering, platform, and compliance teams. 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security. Strong hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration. Experience generating and managing SBOMs using SPDX or CycloneDX. Knowledge of SLSA, NIST SSDF, and NIST SP 800-218. Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto. Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening. Experience with policy-as-code tools such as OPA, Kyverno, or Conftest. Understanding of threat modeling methodologies such as STRI
Extracted skills: python, aws, azure, docker, kubernetes, security, devsecops