Software Supply Chain

Software Supply Chain Engineer Jobs

3 jobs found

1d ago

System Security Engineer Cyber-Supply Chain Risk Management

PeopleTec, Inc. Huntsville, AL

Huntsville, AL

1d ago

Full time Application Security Cybersecurity Tools Dynamic Application Security Testing

Apply Now

Job Description

PeopleTec, Inc. is seeking a System Security Engineer for Cyber-Supply Chain Risk Management (C-SCRM) to support the Huntsville, AL location onsite. In this role, you will help strengthen the software supply chain by analyzing third-party code, dependencies, and build processes, then translating results into findings and improvement plans for senior leadership through the program PMO.

Why this role

Support a program mission by securing software across the full system lifecycle: design, development, acquisition, integration, testing, fielding, and sustainment.
Own and maintain core supply chain artifacts including SBOM governance, vulnerability reporting, and supplier secure software attestation forms.
Collaborate across a multidisciplinary set of teams and coordinate objectives with internal and external organizations.
Deliver clear, actionable reporting by preparing C-SCRM findings, reports, and improvement plans for senior management and stakeholders.

Responsibilities

Provide technical support and security engineering for C-SCRM across the system lifecycle (design, development, acquisition, integration, testing, fielding, and sustainment).
Mandate and manage Software Bills of Materials (SBOMs) for all procured and open-source software.
Perform deep-dive vulnerability analysis and code provenance checks on third-party libraries.
Establish Software Composition Analysis (SCA) and Static Analysis (SAST) requirements within vendor onboarding.
Develop and maintain the Consolidated Program SBOM, Third-Party Software Vulnerability Reports, and Supplier Secure Software Attestation Forms.
Ensure compliance with defense and industry standards by effectively managing C-SCRM processes.
Interface with internal teams and external organizations to coordinate C-SCRM objectives and strategies.
Prepare and present C-SCRM findings, reports, and improvement plans to senior management and stakeholders.
Conduct strategic planning and coordination aligned to program objectives.
Provide technical expertise to peer engineers within Technology Security, Program Protection, Cyber Security, and Technical Management teams.
Use digital tools and methodologies to analyze supply chain risks, manufacturer/supplier relationships, and foreign ownership and controlling influence.
Complete other tasks as assigned by the Chief Engineer and/or Technical Chief.

Requirements

5+ years of relevant experience. Additional education may be substituted for years of experience.
Demonstrated experience in C-SCRM, particularly in defense or aerospace contexts.
Knowledge of SPDX/CycloneDX, SCA, SAST/DAST, VEX, and FIPS 140-3 validation.
Must meet minimum DoDI 8140.03 Defense Cyber Workforce qualification requirements in one of the following work roles:
- 622 (Secure Software Assessor) at the Intermediate level, or
- 652 (Security Architect) at the Intermediate level.
Strong knowledge of industry standards and defense requirements.
Excellent communication and presentation skills.
Ability to lead and work within a multidisciplinary team.
Previous experience working in a U.S. Government Program Office (required).
Travel: 25%.
U.S. Citizenship required.
DoD Secret clearance is required. Candidates must have an active Secret clearance upon hire and the ability to maintain it.

Technologies

SPDX, CycloneDX
Software Composition Analysis (SCA)
SAST/DAST
VEX
FIPS 140-3

Preferred

Top Secret clearance preferred.
DoDI 8140.03 qualification at the Advanced level for work role 622 (Secure Software Assessor) or 652 (Security Architect).

Program support & coordination

You will provide technical support to the program’s Chief Engineer and Technical Chief, securing the software supply chain by evaluating third-party code, dependencies, and build processes for vulnerabilities and malicious logic before integration across the lifecycle. The role also involves coordination and synchronization of C-SCRM technical and programmatic objectives with internal PMs across PAE Fires and external organizations including HQDA, ASA(ALT), JIATF 401, ATEC, AMCOM, and others.

View full job page →

21d ago

Senior Security Engineer - Container & Cloud Security

Ecco Select New York, NY

New York, NY

21d ago

$65 - $65/hr Contract Cloud Native Security Cloud Native Workload Protection Cloud Platforms

Apply Now

Job Description

Ecco Select is hiring a Senior Security Engineer to support a policy-as-code security team focused on automating governance and security controls across Azure and GCP. In this contract role (hybrid in New York), you will help harden Kubernetes workloads, improve runtime detection and incident response, and implement container software supply chain protections using Wiz.

The position is centered on securing containers end to end, including Kubernetes platforms (AKS, GKE, and EKS), Wiz Defend/CWPP runtime capabilities, and Infrastructure-as-Code guardrails built with Terraform, Helm, and GitOps. You will also translate security outcomes into Compliance-as-Code aligned to CIS, NIST, and STIG benchmarks and connect findings to enterprise workflows in ServiceNow.

Responsibilities

Design, implement, and maintain cloud-native container security controls across Kubernetes platforms including AKS, GKE, and EKS.
Develop, tune, and maintain container threat detection rules to identify malicious activity, anomalous behavior, and indicators of compromise across cloud environments.
Monitor runtime security events, investigate security alerts, and lead triage and incident response for container and Kubernetes workloads.
Deploy, configure, and optimize Wiz Defend/CWPP capabilities, including runtime sensors, workload protection, and attack path analysis.
Build and automate security guardrails, admission controller policies, and preventative controls using Infrastructure as Code with Terraform, Helm, and GitOps.
Secure the container software supply chain through image scanning, SBOM validation, image signing, and registry security.
Identify, prioritize, and remediate container vulnerabilities and misconfigurations using risk-based exposure analysis.
Develop and maintain Compliance-as-Code policies aligned with CIS, NIST, and STIG security benchmarks.
Integrate security findings and threat intelligence into ServiceNow and enterprise vulnerability management workflows.
Partner with Security Operations, Cloud Engineering, DevSecOps, and application teams to strengthen detection coverage, incident response, and overall cloud security posture.
Conduct threat hunting and proactive analysis to identify emerging threats and improve detection logic and runtime protection capabilities.
Support post-incident reviews through root cause analysis, corrective-action recommendations, and continuous improvement of detection and response.

Requirements

Strong cloud security knowledge spanning AI/ML platforms, model pipelines, data layers, IAM, networking, and logging.
Hands-on Wiz CNAPP expertise (CSPM, CIEM, DSPM, CWPP), including experience applying it to AI workloads, model hosting, and data pipelines.
Experience designing security controls and architecture at the model, data, and platform levels, including preventive and detective controls.
Compliance-as-Code fluency, including mapping Wiz findings to STIGs, native cloud policies, CI/CD, and governance workflows.
Ability to interpret Wiz risk graphs and communicate risk-based exposure analysis for model misuse, data leakage, privilege escalation, and blast radius.
Kubernetes experience across AKS, GKE, and EKS.
Working knowledge of Terraform, Helm, and GitOps-based pipelines.

Technologies

Wiz, Wiz Defend, CWPP, CSPM, CIEM, DSPM
Kubernetes, AKS, GKE, EKS
Terraform, Helm, GitOps, Azure, GCP
CIS, NIST, STIG
ServiceNow
Container image scanning, SBOM, image signing, registry security
Admission controller, Infrastructure as Code, CI/CD

Benefits

401(k)
401(k) matching
Dental insurance
Health insurance
Paid time off
Retirement plan
Vision insurance

Additional Details

Location: New York, NY (hybrid). Toronto, ON strongly preferred; NY tri-state area (NJ, Philadelphia, NYC) considered as secondary.
Schedule: Full-time, approximately 3 days/week onsite.
Work authorization: GC or USC only.
Interview process: Panel interview with the Hiring Manager and two technical leads.
Duration: 6 months initial, with strong intent to convert to full-time (engagements on this team have extended up to 4 years).
Pay: $65.00 per hour (USD 65 - 65 per hourly).
Work location: Hybrid remote in New York, NY 10001.

View full job page →

1mo ago

Application Security Engineer, AI & Automation

Skill Remote 🌍 Remote

Remote

1mo ago Closed

$90 - $92/hr Contract Ai Governance Ai Security Application Security

This position is no longer accepting applications (closed Aug 22, 2026).

Job Description

Benefits and why you’ll thrive in this role

Skill offers a remote, contract opportunity for a senior Application Security Engineer focused on AI powered automation. This role provides the flexibility of a remote arrangement, a competitive hourly range of USD 90 to 92, and the chance to shape security tooling that leverages frontier large language models for vulnerability identification, code reasoning, triage acceleration, and automated remediation. You will collaborate with distributed teams to impact how security is integrated into developer workflows, with emphasis on unified triage, software supply chain defense, and governance for new AI capabilities across the enterprise.

Responsibilities

AI and Automation Engineering: Test, implement, and optimize application security tooling that uses frontier LLMs to identify vulnerabilities, reason about code, speed triage, and drive automated remediation.
Modern Triage and Incident Response: Deliver unified triage coverage for SCA, SAST, and DAST findings. Lead rapid assessment and routing of threat intelligence escalations and critical patch events (PatchNow).
Software Supply Chain Defense: Strengthen open-source dependency selection, package intake, and SBOM visibility. Build guardrails to detect malicious packages and enforce security policies across developer pipelines.
Secure Developer Workflows: Assess and secure developer environments, including IDEs, plugins/extensions, package managers, and AI coding assistants against malicious code and unsafe configurations.
AI Governance Support: Assist with technical proofs of value, data handling reviews, and model output evaluations required to safely onboard new AI capabilities across the enterprise.

Requirements

Experience: 3+ years of hands-on Application Security, with deep familiarity across the vulnerability lifecycle (SCA, SAST, DAST, and manual verification).
Automation Mindset: Strong engineering fundamentals with scripting languages (Python, Go), APIs, CI/CD pipelines (GitHub Actions, GitLab CI), and developer tool integrations.
AI Curiosity: Practical familiarity or hands-on experimentation with frontier models, AI coding assistants (e.g., Copilot), prompt engineering, or AI orchestration frameworks.
Supply Chain Knowledge: Experience securing software supply chains, package managers, and third-party dependencies against modern attack vectors.
Communication: Ability to translate complex vulnerabilities into clear, actionable remediation guidance for software engineering teams.

Technologies

Python
Go
GitHub Actions
GitLab CI
Copilot

Bonus Points

Contributions to open-source security tools or AI/LLM security projects (for example, OWASP Top 10 for LLMs).
Experience building custom integrations or LLM agents to automate security analyst workflows.

View full job page →

Software Supply Chain Engineer Jobs

System Security Engineer Cyber-Supply Chain Risk Management

Senior Security Engineer - Container & Cloud Security

Application Security Engineer, AI & Automation

Get Software Supply Chain Engineer Jobs alerts