DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

OMG Technology•Boston, MA

9d•Onsite

About The Position

We are seeking a DevSecOps & Supply Chain Security Consultant with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. The consultant will focus on secure SDLC, CI/CD pipeline architecture and security, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependency and secrets management, SAST/DAST, containers, IaC, vulnerability governance, and regulatory evidence. The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions, remediation, release readiness, and residual risk and will produce audit-ready findings and stakeholder-ready reporting.

Requirements

10+ years of experience in secure CI/CD pipeline setup, governance, and controls validation across different technology stacks.
2+ years of hands-on SBOM analysis experience.
Strong understanding of DevSecOps and secure software delivery practices.
Strong experience with SBOM frameworks: CycloneDX, SPDX, VEX/CSAF.
Experience with SCA, SAST, DAST, dependency scanning, and secrets scanning.
Experience with artifact integrity, artifact signing, verification, tamper testing, and build provenance.
Strong knowledge of CI/CD security, secure release governance, and automated security gates.
Experience with vulnerability management, remediation governance, dependency governance, and patch lifecycle management.
Experience with secrets management and secure release controls.
Knowledge of container, registry, build-agent, and CI/CD runner security.
Experience with Infrastructure-as-Code and pipeline-as-code security.
Knowledge of policy-as-code and security controls validation.
Experience with compliance evidence, audit traceability, and regulatory security assessments.
Knowledge of NIST SSDF and secure software supply-chain practices.
Experience with supplier security and software-acquisition assessments.
Hands-on experience with tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins, and Azure DevOps.
Strong documentation and stakeholder communication skills.
Candidate needs to be US Citizen or Green Card holder.

Nice To Haves

Experience with CRA / regulatory security assessments is highly preferred.
Familiarity with SLSA or modern software supply-chain security practices is a plus.
Experience with regulated products, export-controlled environments, or compliance-driven cybersecurity assessments is preferred.
CSSLP
Certified DevSecOps Professional
Other relevant product-security credentials.

Responsibilities

Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management.
Review SDLC processes, security tooling, and secure development practices.
Assess SCA, SBOM accuracy/completeness, dependency governance, and third-party risk.
Evaluate CI/CD pipeline security, artifact integrity, secure release controls, and build provenance.
Validate source-to-release traceability, artifact signing and promotion, tamper resistance, SBOM accuracy, security gates, exceptions, and remediation decisions.
Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls.
Evaluate Infrastructure-as-Code, pipeline-as-code, policy-as-code, and automated security-gate effectiveness.
Review secrets management across development, build, deployment, and operational environments.
Evaluate vulnerability management, remediation tracking, patch governance, EOL/EOS, and release-risk governance.
Assess signing-key, certificate, and HSM lifecycle controls.
Validate SBOM generation and binary-to-SBOM reconciliation.
Support lifecycle security assessments, compliance evidence mapping, and audit traceability.
Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, remediation guidance, and stakeholder-ready executive communication.
Recommend finding-specific follow-up work and support release governance reviews.