Lead enterprise software supply chain security initiatives, including Sonatype and repository governance, open-source software policies, artifact signing, SLSA provenance, SBOM integration, vulnerability remediation, and CI/CD security automation. Design repository strategies, approval workflows, reporting capabilities, and ecosystem onboarding while partnering with security and development teams. The role requires extensive DevSecOps experience, AWS expertise, scripting skills, and knowledge of secure software development frameworks.
Role: DevSecOps Engineer
Location: Atlanta, GA
Hire Type: Direct Hire
Position Type: Full Time
Responsibilities
- Lead the design and enablement of enterprise software supply chain initiatives to support secure software delivery.
- Enhance Sonatype Repository artifact management, IQ firewall policy governance, and open-source software lifecycle processes.
- Define and automate software approval workflows, quarantine waiver processes, and lifecycle management practices.
- Design and enable repository proxy strategies across supported software ecosystems.
- Drive dependency upgrade initiatives and vulnerability remediation workflows.
- Support the design and onboarding of emerging ecosystems, including AI/ML frameworks.
- Design and implement reporting and metrics capabilities to measure software supply chain health, policy compliance, and repository utilization.
- Design and enable CI/CD artifact signing and verification capabilities for software builds.
- Design and implement SLSA build provenance and attestation frameworks across CI/CD platforms.
- Integrate SBOM generation and software metadata into build and deployment pipelines.
- Collaborate closely with security and development teams to enhance software supply chain visibility, integrity, and compliance.
Required Technical Skills
- Minimum 9+ years of experience in DevSecOps, Platform Engineering, or Software Supply Chain Engineering.
- Hands-on experience with Sonatype Lifecycle (IQ Server) and Nexus Repository (or comparable tooling, e.g., jFrog).
- Proven experience creating and maintaining automated Open-Source Software Evaluation policies and workflows.
- Experience implementing artifact signing technologies such as Sigstore/Cosign, GPG, Notary, or similar solutions.
- Strong understanding of SLSA provenance, in-toto attestations, or comparable software supply chain security frameworks.
- Experience with SBOM generation tools and standards, including CycloneDX, SPDX, and Syft.
- CI/CD experience with GitLab preferred, or comparable platforms such as GitHub Actions.
- Strong AWS experience across IAM, ECS/EKS, EC2, S3, Lambda, Step Function, and CloudWatch.
- Experience integrating security tools and controls into CI/CD pipelines.
- Strong scripting and automation skills using Python, Bash, or Go.
- Experience designing, implementing, and maintaining enterprise Open-Source platforms.
- Familiarity with OCI registries and package ecosystems, including Maven, npm, PyPI, and NuGet.
- Knowledge of NIST SSDF, Executive Order 14028, and Secure by Design initiatives.
Similar Jobs
Artificial Intelligence • Consumer Web • Digital Media • Fintech • Marketing Tech • Software • Financial Services
Own and mature the company’s DevSecOps and cloud security function. Responsibilities include implementing SOC 2 controls, automating compliance evidence, managing cloud security posture and runtime security, embedding security gates into CI/CD, leading vulnerability remediation, developing auto-remediation and AI-assisted workflows, and securing infrastructure through Terraform and policy-as-code. The role also partners with GRC and corporate security teams while building reusable security tooling and developer-platform guardrails.
Top Skills:
Ai/Llm ToolingAspmCi/CdContainer ScanningCspmDependency ScanningInfrastructure As Code (Iac)Policy As CodeSastSbomScaSecret ScanningSIEMSoc 2TerraformVulnerability Management
Fintech
Develops and maintains secure, automated cloud CI/CD pipelines and infrastructure using DevSecOps practices. Automates deployments, testing, security workflows, and remediation with Ansible, Terraform, Packer, Python, and PowerShell. Administers endpoint detection, privilege management, and secure access platforms; monitors and responds to security events; supports vulnerability remediation, hardening, compliance, and incident response. Collaborates across engineering, operations, architecture, and security teams while maintaining technical documentation and operational procedures.
Top Skills:
AnsibleAWSAzureAzure DevopsAzure Kubernetes Service (Aks)EdrEpmGitHashicorp VaultJenkinsOpenshiftPackerPowershellPythonServicenowTerraform
Fintech
Develops and maintains secure, automated cloud CI/CD pipelines and immutable infrastructure using DevSecOps practices. Builds automation with Python, PowerShell, Ansible, Terraform, and Packer; integrates testing, security controls, secrets management, and monitoring. Administers endpoint security platforms, investigates alerts and incidents, supports vulnerability remediation and hardening, and collaborates with engineering, operations, and security teams to improve cyber defense capabilities, documentation, compliance, and operational processes.
Top Skills:
AnsibleAWSAzureAzure DevopsAzure Kubernetes Service (Aks)Ci/CdEndpoint Detection And Response (Edr)Endpoint Privilege Management (Epm)GitHashicorp VaultInfrastructure As Code (Iac)JenkinsOpenshiftPackerPowershellPythonServicenowTerraform
What you need to know about the Austin Tech Scene
Austin has a diverse and thriving tech ecosystem thanks to home-grown companies like Dell and major campuses for IBM, AMD and Apple. The state’s flagship university, the University of Texas at Austin, is known for its engineering school, and the city is known for its annual South by Southwest tech and media conference. Austin’s tech scene spans many verticals, but it’s particularly known for hardware, including semiconductors, as well as AI, biotechnology and cloud computing. And its food and music scene, low taxes and favorable climate has made the city a destination for tech workers from across the country.
Key Facts About Austin Tech
- Number of Tech Workers: 180,500; 13.7% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Dell, IBM, AMD, Apple, Alphabet
- Key Industries: Artificial intelligence, hardware, cloud computing, software, healthtech
- Funding Landscape: $4.5 billion in VC funding in 2024 (Pitchbook)
- Notable Investors: Live Oak Ventures, Austin Ventures, Hinge Capital, Gigafund, KdT Ventures, Next Coast Ventures, Silverton Partners
- Research Centers and Universities: University of Texas, Southwestern University, Texas State University, Center for Complex Quantum Systems, Oden Institute for Computational Engineering and Sciences, Texas Advanced Computing Center
