[Hiring] DevSecOps Architect @New Era Technology

Role Description

SecureBlu by New Era Technology is looking for a hands-on DevSecOps Architect specializing in Software Supply Chain Security to help secure software build and release pipelines for our client, Commvault. The ideal candidate will have strong experience securing CI/CD pipelines, managing Software Bills of Materials (SBOMs), implementing artifact signing and provenance verification, and securing Kubernetes environments. This role focuses on hands-on implementation of security controls across the software development lifecycle.

• Design and implement software supply chain security controls across build and release pipelines.
• Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation.
• Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX.
• Integrate dependency scanning and vulnerability management into CI/CD pipelines.
• Implement artifact signing and verification using Sigstore, Cosign, or in-toto.
• Develop and enforce security-as-code and policy-as-code controls using tools such as Open Policy Agent (OPA), Kyverno, or Conftest.
• Secure Kubernetes-based build and deployment environments.
• Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows.
• Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants.
• Align security practices with SLSA, NIST SSDF, and NIST SP 800-218.
• Develop security documentation, reference architectures, runbooks, and audit evidence.
• Collaborate with security, engineering, platform, and compliance teams.

Qualifications

• 5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security.
• Strong hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration.
• Experience generating and managing SBOMs using SPDX or CycloneDX.
• Knowledge of SLSA, NIST SSDF, and NIST SP 800-218.
• Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto.
• Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening.
• Experience with policy-as-code tools such as OPA, Kyverno, or Conftest.
• Understanding of threat modeling methodologies such as STRIDE or attack trees.
• Scripting proficiency in Python, Bash, or Go.
• Familiarity with Docker, OCI images, container registries, and container security.

Preferred Qualifications

• Experience with cloud platforms such as AWS, Azure, or Google Cloud.
• Familiarity with vulnerability management tools such as Snyk or Dependency-Track.
• Experience working in enterprise or regulated software environments.
• Previous consulting or contract experience supporting distributed engineering teams.

Work Arrangement

• Remote position.
• Regular overlap with US business hours is required for cross-team collaboration.
• No routine travel is identified.

Education

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent practical experience.

Application Process

Interested candidates are encouraged to apply with their updated resume.