FREE ACCESS
5,000–10,000 jobs/day
See all jobs on Scoutfield
Search thousands of fresh jobs every day.
Discover
- Fresh listings
- Fast filters
- No subscription required
Create a free account and start exploring right away.
DevSecOps Architect – Software Supply Chain Security
New Era Technology. Design and implement software supply chain security controls across build and release pipelines .
Core Competencies
Role fitCore Competencies
Use this summary to align your resume positioning with the role.
Demonstrates expertise in implementing software supply chain security controls, including SBOM generation and vulnerability management within CI/CD pipelines. Proficient in securing environments using tools like GitHub Actions, Kubernetes, and policy-as-code methodologies.
Highest-signal resume keywords
DevSecOps ExperienceCI/CD Security OwnershipKubernetes Security ExpertiseSBOM Management Using SPDXPolicy-As-Code Implementation
ATS Keywords
Tailor your resumeApplicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.
Hard Skills
SBOM GenerationVulnerability ManagementArtifact SigningThreat ModelingScripting Proficiency in PythonScripting Proficiency in BashScripting Proficiency in GoGitHub ActionsGitLab PipelinesKubernetes Security
Tools & Technologies
SyftCycloneDXSPDXSigstoreCosignIn-totoOPAKyvernoConftestDocker
Industry Keywords
SLSANIST SSDFNIST SP 800-218Security-As-CodePolicy-As-CodeOpen-Source DependenciesAI-Assisted DevelopmentInfrastructure SecurityCI/CD PipelinesContainer Security
Tech Stack
Tools & technologiesDockerKubernetesPythonGo
About the role
Key responsibilities & impact- Design and implement software supply chain security controls across build and release pipelines
- Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation
- Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX
- Integrate dependency scanning and vulnerability management into CI/CD pipelines
- Implement artifact signing and verification using Sigstore, Cosign, or in-toto
- Develop and enforce security-as-code and policy-as-code controls using OPA, Kyverno, or Conftest
- Secure Kubernetes-based build and deployment environments
- Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows
- Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants
- Align security practices with SLSA, NIST SSDF, and NIST SP 800-218
- Develop security documentation, reference architectures, runbooks, and audit evidence
- Collaborate with security, engineering, platform, and compliance teams
Requirements
What you’ll need- 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security
- Strong hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration
- Experience generating and managing SBOMs using SPDX or CycloneDX
- Knowledge of SLSA, NIST SSDF, and NIST SP 800-218
- Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto
- Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening
- Experience with policy-as-code tools such as OPA, Kyverno, or Conftest
- Understanding of threat modeling methodologies such as STRIDE or attack trees
- Scripting proficiency in Python, Bash, or Go
- Familiarity with Docker, OCI images, container registries, and container security
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent practical experience
- Regular overlap with US business hours is required
Benefits
Comp & perks- Competitive benefits
- Continuous training
- Personal and professional development opportunities
- Team-oriented, collaborative and inclusive culture
- No routine travel identified