Software Supply Chain Security Engineer

Job summary

Responsibilities

In this role you will be responsible for assessing and hardening every layer of our source to artifact pipeline, from how we store and manage code to what we deploy into our clusters.

• Define core security requirements for artifact build pipelines including maturing SLSA processes, and see them through from ideation to implementation
• Partner with platform, infrastructure, networking, and hardware teams to identify supply chain gaps and deliver end-to-end solutions for ensuring confidence in CI/CD artifacts
• Develop threat models for each layer of the build and deploy stack, outlining trust boundaries and the interplay between first and third-party mechanisms
• Work with engineering leads and devops architects to build in secure supply chain principles from the beginning
• Balance engineering outcomes with security controls, enabling the company to deliver securely quickly

What they're looking for

• 8-10 years of experience with software supply chain and SDLC topics including secure code management, build pipeline hardening, artifact signing and attestation, and the…
• Masters in Computer Science or PhD (preferred)
• Strong hands-on engineering abilities in devops and SDLC contexts
• Ability to work in fragmented and legacy build environments, experience with modernizing stacks is a plus
• Familiarity with AWS, Jenkins, SLSA, and best practices for secure artifact provenance and builds are a plus

Tech stack

• AWS