DevSecOps Architect – Software Supply Chain Security
New Era Technology3 hours ago
Remote, United StatesSenior / Staff+
H1B sponsor
Responsibilities
- Design and implement software supply chain security controls across build and release pipelines.
- Secure GitHub and GitLab environments through branch protection, signed commits, access controls, and provenance attestation.
- Generate, validate, and distribute SBOMs using Syft, CycloneDX, or SPDX.
- Integrate dependency scanning and vulnerability management into CI/CD pipelines.
- Implement artifact signing and verification with Sigstore, Cosign, or in-toto.
- Develop and enforce security-as-code and policy-as-code controls using OPA, Kyverno, or Conftest.
- Secure Kubernetes-based build and deployment environments, including admission control, network policies, and workload hardening.
- Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows.
- Assess risks from open-source dependencies, AI-generated code, and AI coding assistants.
- Align security practices with SLSA, NIST SSDF, and NIST SP 800-218.
- Create security documentation, reference architectures, runbooks, and audit evidence.
- Collaborate with security, engineering, platform, and compliance teams.
Requirements
- 5–8 years of experience in DevSecOps, application security, or platform engineering with direct ownership of CI/CD security.
- Hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration.
- Experience generating and managing SBOMs using SPDX or CycloneDX.
- Knowledge of SLSA, NIST SSDF, and NIST SP 800-218.
- Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto.
- Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening.
- Experience with policy-as-code tools such as OPA, Kyverno, or Conftest.
- Understanding of STRIDE or attack-tree threat modeling methodologies.
- Scripting proficiency in Python, Bash, or Go.
- Familiarity with Docker, OCI images, container registries, and container security.
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent practical experience.
- Preferred qualifications include experience with AWS, Azure, or Google Cloud; vulnerability management tools such as Snyk or Dependency-Track; enterprise or regulated software environments; and consulting or contract work supporting distributed engineering teams.
Benefits
- Remote position with regular overlap during US business hours required for cross-team collaboration.
- No routine travel is identified.
- Competitive benefits, continuous training, and professional development opportunities are offered.
About New Era Technology
New Era Technology provides managed IT and communications services—collaboration/UC, data networking, cloud (CloudBlu), cybersecurity (SecureBlu), physical security, and ongoing managed/professional services—for enterprises, healthcare, education, finance, and government. The privately held company, headquartered in West Chester, PA, operates across the Americas, EMEA, and APAC and implements multi-vendor solutions as a Cisco, Avaya, Palo Alto, Fortinet, Crestron, and Polycom partner.