DevSecOps / Software Supply Chain Security Engineer

Staffana is seeking an experienced DevSecOps / Software Supply Chain Security Engineer to strengthen security across cloud-native and SaaS/on-premises software development environments. The role focuses on securing software factories, CI/CD infrastructure, software artifacts, source-control environments, SBOMs, vulnerability management, artifact signing and attestation, and security governance.

Responsibilities:

• Apply Secure SDLC, OWASP, and OWASP SAMM principles throughout the development lifecycle
• Implement Security & Privacy by Design practices
• Audit and secure CI/CD pipelines and software factory infrastructure
• Apply SLSA principles to software build and delivery processes
• Build or support artifact signing and attestation infrastructure
• Generate, capture, validate, and store SBOMs for software artifacts during CI/build processes
• Centralize artifact storage and support secure replication across environments
• Perform SAST, DAST, SCA, and container security assessments
• Analyze CVEs and prioritize vulnerabilities using risk-based approaches such as EPSS
• Conduct threat modeling and security architecture reviews
• Harden source-control and SCM infrastructure
• Perform security audits using CIS Benchmarks and related security standards
• Support configuration management for artifact signing, provenance, and attestation
• Develop security findings, risk assessments, audit reports, dashboards, and recommendations
• Partner with Development, DevOps, Cloud, Infrastructure, and Security teams

Requirements:

• • 7+ years of experience in DevSecOps, Application Security, Product Security, Cloud Security, Software Security , or a related discipline
• • Strong understanding of Secure SDLC and security architecture
• • Hands-on experience securing CI/CD pipelines
• • Experience with SBOMs and software dependency analysis
• • Strong understanding of Software Supply Chain Security
• • Experience with SAST, DAST, SCA , and vulnerability management
• • Knowledge of SLSA , software provenance, artifact signing , and artifact attestation
• • Experience with cloud-native environments , preferably AWS
• • Experience with Docker/Kubernetes or similar container technologies
• • Experience with threat modeling , preferably STRIDE
• • Strong understanding of OWASP application-security principles
• • Excellent written and verbal communication skills
• • Must be a US Citizen
• • Must currently be US-based
• • Must be comfortable working fully remotely
• • Must have strong communication skills
• • Must be available for a 6-month contract
• • W2 and 1099 accepted; no C2C
• • Konflux
• • Sigstore / Cosign
• • Notary
• • OSBuild
• • CycloneDX / SPDX
• • Syft / Grype / Trivy
• • Snyk
• • Cycode
• • Satori
• • GitHub / GitLab
• • Jenkins
• • AWS / Kubernetes
• • EPSS
• • CIS Benchmarks