DevSecOps Architect – Software Supply Chain Security
Hands-on DevSecOps architect in New Era's SecureBlu practice, embedded with client Commvault to secure software supply chains: hardening GitHub/GitLab and CI/CD pipelines, generating SBOMs, implementing artifact signing and provenance (Sigstore/Cosign), and securing Kubernetes with policy-as-code per SLSA/NIST standards.
- Compensation
- Not disclosed
- Location
- Remote
- Work setup
- Remote
- Seniority
- Not specified
- Employment
- Contract
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security
- Hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration
- Experience generating and managing SBOMs using SPDX or CycloneDX
- Knowledge of SLSA, NIST SSDF, and NIST SP 800-218
- Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto
- Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening
- Experience with policy-as-code tools such as OPA, Kyverno, or Conftest
- Understanding of threat modeling methodologies such as STRIDE or attack trees
- Scripting proficiency in Python, Bash, or Go
- Familiarity with Docker, OCI images, container registries, and container security
- Bachelor's degree in Computer Science, Information Security, Engineering, or related field, or equivalent practical experience
Nice to have
- Experience with cloud platforms such as AWS, Azure, or Google Cloud
- Familiarity with vulnerability management tools such as Snyk or Dependency-Track
- Experience working in enterprise or regulated software environments
- Previous consulting or contract experience supporting distributed engineering teams
Full description
Join New Era Technology, where People First is at the heart of everything we do. With a global team of over 3,000 professionals, we're committed to creating a workplace where everyone feels valued, empowered, and inspired to grow. Our mission is to securely connect people, places, and information with end-to-end technology solutions at scale.
At New Era, you'll join a team-oriented culture that prioritizes your personal and professional development. Work alongside industry-certified experts, access continuous training, and enjoy competitive benefits. Guided by our core attributes — putting people first, embracing continuous learning, and thriving through collaboration and inclusion — we nurture our people to deliver exceptional customer service.
If you want to make an impact in a supportive, growth-oriented environment, New Era is the place for you. Apply today and help us shape the future of work—together
SecureBlu by New Era Technology is looking for a hands-on DevSecOps Architect specializing in Software Supply Chain Security to help secure software build and release pipelines for our client, Commvault.
The ideal candidate will have strong experience securing CI/CD pipelines, managing Software Bills of Materials (SBOMs), implementing artifact signing and provenance verification, and securing Kubernetes environments. This role focuses on hands-on implementation of security controls across the software development lifecycle.
Key Responsibilities
-
Design and implement software supply chain security controls across build and release pipelines.
-
Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation.
-
Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX.
-
Integrate dependency scanning and vulnerability management into CI/CD pipelines.
-
Implement artifact signing and verification using Sigstore, Cosign, or in-toto.
-
Develop and enforce security-as-code and policy-as-code controls using tools such as Open Policy Agent (OPA), Kyverno, or Conftest.
-
Secure Kubernetes-based build and deployment environments.
-
Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows.
-
Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants.
-
Align security practices with SLSA, NIST SSDF, and NIST SP 800-218.