Skip to main content
David Careers

Senior DevSecOps Engineer

Posted yesterday

system one holdingsVestavia Hills (AL)
Computer Systems Engineers/ArchitectsComputer Systems Design Services

SENIORITY

Lead

Apply (opens in a new tab)

About the role

Senior DevSecOps Engineer Permanent Full-Time Lafayette, LA | Knoxville, TN | Birmingham, AL | Columbia SCPosition Description This role focuses on improving software supply chain security, artifact management, open-source governance, CI/CD security, SBOM generation, artifact signing, and software provenance across enterprise environments.
Key Responsibilities:
  • Enhance artifact management, policy governance, and open-source lifecycle processes using tools such as Sonatype Lifecycle (IQ Server), Nexus Repository, or JFrog.
  • Build and automate software approval workflows, including quarantine and waiver processes.
  • Develop and maintain repository proxy strategies across supported software ecosystems.
  • Drive dependency upgrades and vulnerability remediation initiatives.
  • Support onboarding of emerging ecosystems, including AI/ML frameworks.
  • Build reporting and metrics for:
  • Software supply chain health
  • Policy compliance
  • Repository utilization
  • Enable CI/CD artifact signing and verification.
  • Implement SLSA build provenance and attestations.
  • Integrate SBOM generation into build and deployment pipelines.
  • Partner with security and development teams to improve software supply chain visibility, integrity, and security across the organization.
  • Help build secure and trustworthy software delivery pipelines at enterprise scale.
Required Qualifications: 5+ years of experience in:
  • DevSecOpsPlatform Engineering
  • Software Supply Chain Engineering
  • Hands-on experience with:
  • Sonatype Lifecycle / IQ ServerNexus Repository
Or similar tools such as JFrogExperience building and maintaining automated Open Source Software evaluation policies and workflows. Experience with artifact signing technologies such as: Sigstore CosignGPGNotaryExperience with: SLSA provenancein-toto attestations Similar software supply chain frameworks Experience generating SBOMs using: CycloneDXSPDXSyftStrong CI/CD experience, preferably: GitLabGitHub Actions also acceptable Strong AWS experience with: IAMECS / EKSEC2S3LambdaStep Functions CloudWatchExperience integrating security tooling directly into CI/CD pipelines. Strong scripting skills in: PythonBashGoExperience maintaining enterprise open-source platforms. Familiarity with OCI registries and package ecosystems such as: Mavennpm PyPINuGetKnowledge of: NIST SSDFExecutive Order 14028 Secure by Design principles Educational Requirement Bachelor's degree in Computer Science, Information Systems, or a related field. Ref: #404-IT Pittsburgh

Before you apply

Applying takes about a minute. These four things decide how fast it moves after that.

Your profile is current

It's what we read first. Occupations, seniority and locations matter more than a long history.

Two examples you can talk through

Not a portfolio — just two pieces of work where you can explain the decisions and what you'd change.

A number in mind

What you're on now and what would make you move. We negotiate better when we know both.

Your notice period

Employers plan around it, and it's the question that stalls offers most often.

Once you apply, someone reads it and calls you before anything reaches the employer — usually within two working days.

More like this