Senior DevSecOps Engineer Permanent Full-Time
Lafayette, LA | Knoxville, TN | Birmingham, AL | Columbia SC Position Description This role focuses on improving
software supply chain security, artifact management, open-source governance, CI/CD security, SBOM generation, artifact signing, and software provenance across enterprise environments.
Key Responsibilities - Enhance artifact management, policy governance, and open-source lifecycle processes using tools such as Sonatype Lifecycle (IQ Server), Nexus Repository, or JFrog.
- Build and automate software approval workflows, including quarantine and waiver processes.
- Develop and maintain repository proxy strategies across supported software ecosystems.
- Drive dependency upgrades and vulnerability remediation initiatives.
- Support onboarding of emerging ecosystems, including AI/ML frameworks.
- Build reporting and metrics for:
- Software supply chain health
- Policy compliance
- Repository utilization
- Enable CI/CD artifact signing and verification.
- Implement SLSA build provenance and attestations.
- Integrate SBOM generation into build and deployment pipelines.
- Partner with security and development teams to improve software supply chain visibility, integrity, and security across the organization.
- Help build secure and trustworthy software delivery pipelines at enterprise scale.
Required Qualifications - 5+ years of experience in:
- DevSecOps
- Platform Engineering
- Software Supply Chain Engineering
- Hands-on experience with:
- Sonatype Lifecycle / IQ Server
- Nexus Repository
- Or similar tools such as JFrog
- Experience building and maintaining automated Open Source Software evaluation policies and workflows.
- Experience with artifact signing technologies such as:
- Experience with:
- SLSA provenance
- in-toto attestations
- Similar software supply chain frameworks
- Experience generating SBOMs using:
- Strong CI/CD experience, preferably:
- GitLab
- GitHub Actions also acceptable
- Strong AWS experience with:
- IAM
- ECS / EKS
- EC2
- S3
- Lambda
- Step Functions
- CloudWatch
- Experience integrating security tooling directly into CI/CD pipelines.
- Strong scripting skills in:
- Experience maintaining enterprise open-source platforms.
- Familiarity with OCI registries and package ecosystems such as:
- Knowledge of:
- NIST SSDF
- Executive Order 14028
- Secure by Design principles
Educational Requirement Bachelor's degree in Computer Science, Information Systems, or a related field.
