Lead enterprise software supply chain security initiatives, including Sonatype and repository governance, open-source software policies, artifact signing, SLSA provenance, SBOM integration, vulnerability remediation, and CI/CD security automation. Design repository strategies, approval workflows, reporting capabilities, and ecosystem onboarding while partnering with security and development teams. The role requires extensive DevSecOps experience, AWS expertise, scripting skills, and knowledge of secure software development frameworks.
Role: DevSecOps Engineer
Location: Atlanta, GA
Hire Type: Direct Hire
Position Type: Full Time
Responsibilities
- Lead the design and enablement of enterprise software supply chain initiatives to support secure software delivery.
- Enhance Sonatype Repository artifact management, IQ firewall policy governance, and open-source software lifecycle processes.
- Define and automate software approval workflows, quarantine waiver processes, and lifecycle management practices.
- Design and enable repository proxy strategies across supported software ecosystems.
- Drive dependency upgrade initiatives and vulnerability remediation workflows.
- Support the design and onboarding of emerging ecosystems, including AI/ML frameworks.
- Design and implement reporting and metrics capabilities to measure software supply chain health, policy compliance, and repository utilization.
- Design and enable CI/CD artifact signing and verification capabilities for software builds.
- Design and implement SLSA build provenance and attestation frameworks across CI/CD platforms.
- Integrate SBOM generation and software metadata into build and deployment pipelines.
- Collaborate closely with security and development teams to enhance software supply chain visibility, integrity, and compliance.
Required Technical Skills
- Minimum 9+ years of experience in DevSecOps, Platform Engineering, or Software Supply Chain Engineering.
- Hands-on experience with Sonatype Lifecycle (IQ Server) and Nexus Repository (or comparable tooling, e.g., jFrog).
- Proven experience creating and maintaining automated Open-Source Software Evaluation policies and workflows.
- Experience implementing artifact signing technologies such as Sigstore/Cosign, GPG, Notary, or similar solutions.
- Strong understanding of SLSA provenance, in-toto attestations, or comparable software supply chain security frameworks.
- Experience with SBOM generation tools and standards, including CycloneDX, SPDX, and Syft.
- CI/CD experience with GitLab preferred, or comparable platforms such as GitHub Actions.
- Strong AWS experience across IAM, ECS/EKS, EC2, S3, Lambda, Step Function, and CloudWatch.
- Experience integrating security tools and controls into CI/CD pipelines.
- Strong scripting and automation skills using Python, Bash, or Go.
- Experience designing, implementing, and maintaining enterprise Open-Source platforms.
- Familiarity with OCI registries and package ecosystems, including Maven, npm, PyPI, and NuGet.
- Knowledge of NIST SSDF, Executive Order 14028, and Secure by Design initiatives.
Hexaware Technologies San Ramon, California, USA Office
3001 Bishop Drive Suite 300, Office 3108, San Ramon, United States, 94583
Similar Jobs
Artificial Intelligence • Cloud • Information Technology • Consulting
Secure CI/CD pipelines and cloud infrastructure through automated SAST, DAST, vulnerability scanning, IaC enforcement, container security, secrets management, and observability. The intern will use Terraform, Docker, Vault, and monitoring tools to protect applications and AI agents, collaborate with developers on vulnerability remediation, and implement security controls for Node.js, React, and LLM-based systems.
Top Skills:
BashDastDockerGrafanaLangchainLlamaindexLokiMakefileNestjsNext.JsNode.jsOracle CloudPrometheusPythonReactSastTerraformTraefikTypescriptVault
Information Technology • Software • Consulting • Cybersecurity
Designs and sustains secure Microsoft Azure capabilities, including AKS, infrastructure automation, CI/CD, observability, identity, secrets management, and secure deployment controls. Troubleshoots complex platform, API, data, security, and performance issues; translates stakeholder requirements into maintainable solutions; supports architecture, releases, documentation, testing, and operational readiness. Collaborates with government, cybersecurity, engineering, QA, and operations teams in regulated environments.
Top Skills:
APIsApplication InsightsAtlassianAzure DevopsAzure Key VaultAzure Kubernetes Service (Aks)Azure MonitorBicepCi/CdContainer PlatformsGithub ActionsInfrastructure As CodeKubernetesLog AnalyticsMicrosoft 365AzureMicrosoft Defender For CloudMicrosoft Entra IdServicenowSnowflake
Cloud • Logistics • Software • Transportation • Automation
Design and operate secure Azure infrastructure, infrastructure-as-code modules, CI/CD security controls, vulnerability management, and penetration testing programs. Deploy and monitor internal security, IT, and AI tools using containers, identity, secrets management, telemetry, dashboards, and alerts. Partner with engineering, DevOps, IT, security teams, and external vendors while documenting procedures and producing SOC 2 evidence.
Top Skills:
.NetAikidoAksAngularApp ServiceApplication InsightsAzureAzure Container RegistryAzure Cosmos DbAzure DevopsAzure FunctionsAzure Key VaultAzure MonitorAzure StorageAzure VnetsBashC#ClaudeClaude PlatformCloudflareCursorDockerGithub ActionsGrafanaGrokbotKqlKubernetesLog AnalyticsMicrosoft Entra IdOpentelemetryPowershellPythonReactTerraformTypescript
What you need to know about the San Francisco Tech Scene
San Francisco and the surrounding Bay Area attracts more startup funding than any other region in the world. Home to Stanford University and UC Berkeley, leading VC firms and several of the world’s most valuable companies, the Bay Area is the place to go for anyone looking to make it big in the tech industry. That said, San Francisco has a lot to offer beyond technology thanks to a thriving art and music scene, excellent food and a short drive to several of the country’s most beautiful recreational areas.
Key Facts About San Francisco Tech
- Number of Tech Workers: 365,500; 13.9% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Google, Apple, Salesforce, Meta
- Key Industries: Artificial intelligence, cloud computing, fintech, consumer technology, software
- Funding Landscape: $50.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Sequoia Capital, Andreessen Horowitz, Bessemer Venture Partners, Greylock Partners, Khosla Ventures, Kleiner Perkins
- Research Centers and Universities: Stanford University; University of California, Berkeley; University of San Francisco; Santa Clara University; Ames Research Center; Center for AI Safety; California Institute for Regenerative Medicine
