Highlights

This role focuses on improving software supply chain security, artifact management, open-source governance, CI/CD security, SBOM generation, artifact signing, and software provenance across enterprise environments. Enhance artifact management, policy governance, and open-source lifecycle processes using tools such as Sonatype Lifecycle (IQ Server), Nexus Repository, or JFrog .

Description

Senior DevSecOps Engineer
Permanent Full-Time
Lafayette, LA | Knoxville, TN | Birmingham, AL | Columbia SC

Position Description
This role focuses on improving software supply chain security, artifact management, open-source governance, CI/CD security, SBOM generation, artifact signing, and software provenance across enterprise environments.
Key Responsibilities

Enhance artifact management, policy governance, and open-source lifecycle processes using tools such as Sonatype Lifecycle (IQ Server), Nexus Repository, or JFrog.
Build and automate software approval workflows, including quarantine and waiver processes.
Develop and maintain repository proxy strategies across supported software ecosystems.
Drive dependency upgrades and vulnerability remediation initiatives.
Support onboarding of emerging ecosystems, including AI/ML frameworks.
Build reporting and metrics for:
- Software supply chain health
- Policy compliance
- Repository utilization
Enable CI/CD artifact signing and verification.
Implement SLSA build provenance and attestations.
Integrate SBOM generation into build and deployment pipelines.
Partner with security and development teams to improve software supply chain visibility, integrity, and security across the organization.
Help build secure and trustworthy software delivery pipelines at enterprise scale.

Required Qualifications

5+ years of experience in:
- DevSecOps
- Platform Engineering
- Software Supply Chain Engineering
Hands-on experience with:
- Sonatype Lifecycle / IQ Server
- Nexus Repository
- Or similar tools such as JFrog
Experience building and maintaining automated Open Source Software evaluation policies and workflows.
Experience with artifact signing technologies such as:
- Sigstore
- Cosign
- GPG
- Notary
Experience with:
- SLSA provenance
- in-toto attestations
- Similar software supply chain frameworks
Experience generating SBOMs using:
- CycloneDX
- SPDX
- Syft
Strong CI/CD experience, preferably:
- GitLab
- GitHub Actions also acceptable
Strong AWS experience with:
- IAM
- ECS / EKS
- EC2
- S3
- Lambda
- Step Functions
- CloudWatch
Experience integrating security tooling directly into CI/CD pipelines.
Strong scripting skills in:
- Python
- Bash
- Go
Experience maintaining enterprise open-source platforms.
Familiarity with OCI registries and package ecosystems such as:
- Maven
- npm
- PyPI
- NuGet
Knowledge of:
- NIST SSDF
- Executive Order 14028
- Secure by Design principles

Educational Requirement
Bachelor’s degree in Computer Science, Information Systems, or a related field.

About Company

Every day, System One focuses on services and solutions that require a high degree of specialization, in-demand technical skills, and large-scale operational expertise. We are essential partners to those on the front lines of our nation’s most critical infrastructure, technology, and life sciences initiatives.

Founded more than 40 years ago as a staffing partner to the engineering industry, today System One is a diversified organization operating in over 50 locations and putting more than 9,000 people to work in the United States, Canada, and the United Kingdom.

New!