Software Supply Chain Security Engineer

You will assess and harden the source-to-artifact pipeline, including code management, build processes, and cluster deployments. You will define security requirements, develop threat models, partner with technical leads, embed secure supply-chain practices into development, and document security posture and strategy.

Responsibilities

• Define and implement core security requirements for artifact build pipelines
• Mature SLSA processes
• Identify supply-chain gaps and deliver end-to-end solutions for CI/CD artifacts
• Develop threat models for the build and deployment stack
• Embed secure supply-chain principles into engineering practices
• Balance security controls with engineering delivery outcomes
• Document security posture and strategy for technical and nontechnical audiences

Requirements

• 8–10 years of experience with software supply chain and SDLC topics
• Hands-on engineering ability in DevOps and SDLC contexts
• Ability to work in fragmented and legacy build environments
• Strong written communication skills
• Direct experience with agentic workflows
• Deep understanding of LLM and reasoning cycles