OpenSource Security Engineer

Infosys

57d

About The Position

In the assigned Job Role of Engineering Consultant 2, your Area Of Responsibility will be as below: * Elicit and document business and technical requirements, translating them into actionable specifications for the team * Participate in design meetings, create initial design concepts, and support the development of design sketches and models using established engineering tools and techniques * Participate in iterative engineering design cycles, refine prototypes, and coordinate with teams to implement feedback effectively * Develop and refine solution specifications and perform validation activities, including simulations, to ensure that engineering solutions meet design specifications and criteria * Build and refine prototypes, incorporating testing results and feedback received from cross-functional team, to enhance functionality * Undertake technical integration efforts, ensure system functionality, identify and resolve interoperability issues * Develop and maintain comprehensive technical documentation and assist in organizing knowledge-sharing sessions among team members Your contribution to the team: * A collaborative spirit and excellent communication skills. * Ability to analyze complex requirements and propose effective solutions basis engineering tools and methodologies * Innovative mindset to address challenges and improve processes in line with industry trends * Commitment to continuous improvement and knowledge sharing

Requirements

Experience in DevSecOps, Platform Engineering, or Software Supply Chain Security.
Hands-on experience with Sonatype Lifecycle (IQ Server), Nexus Repository, or comparable solutions such as JFrog.
Experience developing and managing Open-Source Software (OSS) governance policies, evaluation workflows, and automation.
Knowledge of artifact signing and integrity verification technologies, including Sigstore/Cosign, GPG, and Notary.
Experience implementing SLSA provenance, in-toto attestations, and software supply chain security controls.
Hands-on experience generating and managing SBOMs using tools such as CycloneDX, SPDX, or Syft.
Strong experience with AWS services, including IAM, ECS/EKS, EC2, S3, Lambda, Step Functions, and CloudWatch.
Experience integrating security and compliance controls into CI/CD pipelines.
Proficiency in scripting and automation using Python, Bash, or Go.
Experience designing, deploying, and supporting enterprise Open-Source platforms and repositories.
Familiarity with OCI registries and package ecosystems such as Maven, npm, PyPI, and NuGet.
Strong understanding of NIST SSDF, Executive Order 14028, Secure by Design principles, and modern software supply chain security practices.

Nice To Haves

Experience securing and onboarding AI/ML open-source ecosystems.
Enterprise Open-Source Platform Engineering experience.
Experience developing software supply chain governance metrics, reporting, and dashboards.
CI/CD experience with GitLab, GitHub Actions, or similar platforms.

Responsibilities

Elicit and document business and technical requirements, translating them into actionable specifications for the team
Participate in design meetings, create initial design concepts, and support the development of design sketches and models using established engineering tools and techniques
Participate in iterative engineering design cycles, refine prototypes, and coordinate with teams to implement feedback effectively
Develop and refine solution specifications and perform validation activities, including simulations, to ensure that engineering solutions meet design specifications and criteria
Build and refine prototypes, incorporating testing results and feedback received from cross-functional team, to enhance functionality
Undertake technical integration efforts, ensure system functionality, identify and resolve interoperability issues
Develop and maintain comprehensive technical documentation and assist in organizing knowledge-sharing sessions among team members