DevSecOps Lead/Architect (with Supply Chain and SBOM)

Role Summary

Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.

Key Responsibilities

• Review SDLC processes, tooling, and secure development practices

• Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk

• Evaluate CI/CD pipeline security, artifact integrity, and secure release controls

• Review secrets management across development, build, deployment, and operational environments

• Assess logging, auditability, and security event traceability controls

• Evaluate vulnerability management, remediation tracking, and patch governance processes

• Support lifecycle security assessment, compliance evidence mapping, and traceability

• Contribute to assessment reporting, remediation guidance, and release governance reviews

Required Skills & Experience

Mandatory:

• Strong understanding of DevSecOps and secure software delivery practices

• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling

• Familiarity with CI/CD security controls and artifact integrity validation

• Experience with vulnerability management and dependency governance programs

• Understanding of lifecycle security, auditability, and compliance evidence requirements

• Experience with secrets management and secure release governance

Good to have:

• Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments

• Experience participating in engagement related to export-controlled environments

• Strong documentation skills

Preferred Certifications

• Kubernetes / Cloud Security certifications preferred

• DevSecOps or secure software supply chain experience preferred

• Familiarity with SLSA or modern software supply chain security practices

• Clearance / Compliance Requirements

Years of Required Experience 

• 7-10 years in setting up, maintaining and controls validation of Secure. CI/CD pipelines across different type of tech stack.

• 2+ Years experience with SBOM analysis