DevSecOps & Supply Chain Security Consultant
Tewksbury, Massachusetts, United States of America
Contract
4 days ago
Key skills
KubernetesSDLCCI/CDCloud Security
About this role
Role: DevSecOps & Supply Chain Security Consultant
Work Location: Tewksbury, MA 01876 (Hybrid)
Duration:6-12 months
Role Summary
Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.
Key Responsibilities
Review SDLC processes, tooling, and secure development practices
Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk
Evaluate CI/CD pipeline security, artifact integrity, and secure release controls
Review secrets management across development, build, deployment, and operational environments
Assess logging, auditability, and security event traceability controls
Evaluate vulnerability management, remediation tracking, and patch governance processes
Support lifecycle security assessment, compliance evidence mapping, and traceability
Contribute to assessment reporting, remediation guidance, and release governance reviews
Required Skills & Experience
Mandatory:
Strong understanding of DevSecOps and secure software delivery practices
Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling
Familiarity with CI/CD security controls and artifact integrity validation
Experience with vulnerability management and dependency governance programs
Understanding of lifecycle security, auditability, and compliance evidence requirements
Experience with secrets management and secure release governance
Good to have:
Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments
Experience participating in engagement related to export-controlled environments
Strong documentation skills
Preferred Certifications
Kubernetes / Cloud Security certifications preferred
DevSecOps or secure software supply chain experience preferred
Familiarity with SLSA or modern software supply chain security practices
Clearance / Compliance Requirements
Years of Required Experience
7-10 years in setting up, maintaining and controls validation of Secure. CI/CD pipelines across different type of tech stack.
2+ Years experience with SBOM analysis