Note: The job is a remote job and is open to candidates in USA. Staffana is seeking an experienced DevSecOps / Software Supply Chain Security Engineer to strengthen security across cloud-native and SaaS/on-premises software development environments. The role focuses on securing software factories, CI/CD infrastructure, software artifacts, source-control environments, SBOMs, vulnerability management, artifact signing and attestation, and security governance.
Responsibilities
- Apply Secure SDLC, OWASP, and OWASP SAMM principles throughout the development lifecycle
- Implement Security & Privacy by Design practices
- Audit and secure CI/CD pipelines and software factory infrastructure
- Apply SLSA principles to software build and delivery processes
- Build or support artifact signing and attestation infrastructure
- Generate, capture, validate, and store SBOMs for software artifacts during CI/build processes
- Centralize artifact storage and support secure replication across environments
- Perform SAST, DAST, SCA, and container security assessments
- Analyze CVEs and prioritize vulnerabilities using risk-based approaches such as EPSS
- Conduct threat modeling and security architecture reviews
- Harden source-control and SCM infrastructure
- Perform security audits using CIS Benchmarks and related security standards
- Support configuration management for artifact signing, provenance, and attestation
- Develop security findings, risk assessments, audit reports, dashboards, and recommendations
- Partner with Development, DevOps, Cloud, Infrastructure, and Security teams
Skills
- • 7+ years of experience in DevSecOps, Application Security, Product Security, Cloud Security, Software Security , or a related discipline
- • Strong understanding of Secure SDLC and security architecture
- • Hands-on experience securing CI/CD pipelines
- • Experience with SBOMs and software dependency analysis
- • Strong understanding of Software Supply Chain Security
- • Experience with SAST, DAST, SCA , and vulnerability management
- • Knowledge of SLSA , software provenance, artifact signing , and artifact attestation
- • Experience with cloud-native environments , preferably AWS
- • Experience with Docker/Kubernetes or similar container technologies
- • Experience with threat modeling , preferably STRIDE
- • Strong understanding of OWASP application-security principles
- • Excellent written and verbal communication skills
- • Must be a US Citizen
- • Must currently be US-based
- • Must be comfortable working fully remotely
- • Must have strong communication skills
- • Must be available for a 6-month contract
- • W2 and 1099 accepted; no C2C
- • Konflux
- • Sigstore / Cosign
- • Notary
- • OSBuild
- • CycloneDX / SPDX
- • Syft / Grype / Trivy
- • Snyk
- • Cycode
- • Satori
- • GitHub / GitLab
- • Jenkins
- • AWS / Kubernetes
- • EPSS
- • CIS Benchmarks
Benefits
- Fully remote — United States
Company Overview