Location: Richardson, TX 75082
Contract Duration: 12 Months
Experience Required: 8–10 Years
Job Description
We are seeking an experienced DevSecOps & Software Supply Chain Engineering to lead the design and enablement of enterprise software supply chain initiatives that support secure software delivery.
The ideal candidate will have hands-on experience with Sonatype Lifecycle (IQ Server), Nexus Repository, open-source software governance, and automated software evaluation workflows. The role will focus on artifact management, vulnerability remediation, software approval processes, CI/CD artifact signing, SLSA provenance, and Software Bill of Materials (SBOM) integration.
Key Responsibilities
-
Lead the design and implementation of enterprise software supply chain initiatives to support secure software delivery.
-
Enhance Sonatype Repository artifact management and IQ Firewall policy governance.
-
Establish and manage open-source software lifecycle processes.
-
Define and automate software approval workflows, quarantine processes, waivers, and lifecycle management.
-
Design and enable repository proxy strategies for supported software ecosystems.
-
Drive dependency upgrades and vulnerability remediation workflows.
-
Support the design and onboarding of emerging ecosystems, including AI/ML frameworks.
-
Develop reporting and metrics to measure software supply chain health, policy compliance, and repository utilization.
-
Design and enable CI/CD artifact signing and verification capabilities.
-
Implement SLSA build provenance and attestations across CI/CD platforms.
-
Integrate SBOM generation and software metadata into build and deployment pipelines.
-
Collaborate with security and development teams to improve software supply chain visibility and integrity.
Required Qualifications
-
8–10 years of experience in DevSecOps, Platform Engineering, or Software Supply Chain Engineering.
-
Hands-on experience with Sonatype Lifecycle (IQ Server) and Nexus Repository or comparable tools.
-
Experience creating and maintaining automated Open Source Software (OSS) evaluation policies and workflows.
-
Strong understanding of software artifact management and repository governance.
-
Experience with CI/CD pipelines and secure software delivery practices.
-
Knowledge of software approval workflows, quarantine processes, waivers, and vulnerability remediation.
-
Strong collaboration skills with security, development, and platform engineering teams.
Primary Skills
-
DevSecOps
-
Software Supply Chain Engineering
-
Sonatype Lifecycle (IQ Server)
-
Nexus Repository
-
Open Source Software (OSS) Governance
-
Software Evaluation Policies
-
CI/CD Security
Secondary Skills
-
SLSA Build Provenance
-
in-toto Attestations
-
SBOM Generation
-
CycloneDX
-
SPDX
-
Syft
-
Artifact Signing and Verification
-
Vulnerability Remediation
-
AI/ML Framework Onboarding
-
Repository Proxy Management
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, sexual orientation, and gender identity), national origin, age, disability, genetic information, protected veteran status, or any other characteristic protected by applicable federal, state, or local law.
We are committed to providing reasonable accommodations to qualified applicants with disabilities and for sincerely held religious beliefs, as required by applicable law. Applicants who require a reasonable accommodation during the hiring process may request assistance.
Employment may be contingent upon the successful completion of job-related pre-employment screening, which may include background and reference checks and, where permitted by applicable law and applicable to the position, drug testing. All such screening will be conducted in accordance with applicable federal, state, and local laws.
