Senior Engineer – Software Supply Chain Security

GEICO • Bethesda, MD

4d • $100,000 - $215,000

About The Position

GEICO is seeking a hands-on product security engineer to reduce risk across the software development and delivery lifecycle. The role designs, engineers, operates, and validates security capabilities that protect source code, dependencies, build environments, CI/CD pipelines, artifacts, containers, infrastructure-as-code, and production releases. It also extends software supply chain assurance to AI-enabled products by securing models, datasets, prompts, agents, frameworks, and supporting services throughout their lifecycle.

The Senior Engineer will influence architecture, integrate automated controls into developer workflows, and create reusable guardrails and practical solutions with product, platform, security, cloud, data science, privacy, legal, risk, and incident-response teams. The role addresses risks such as compromised dependencies, build systems, credentials, artifacts, models, and data, while helping mature GEICO’s software supply chain security program. Success means engineering teams can consume software and AI components securely, build in trusted environments, verify provenance and integrity, identify risks early, and release products with confidence.

Requirements

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or equivalent practical experience.
• Professional software engineering, platform engineering, application security, or product security experience in enterprise or cloud-native environments.
• Proficiency in at least one programming or scripting language such as Go, Rust, Java, C++, JavaScript, .NET, or Python.
• Demonstrated experience with source code management, build systems, CI/CD pipelines, artifact repositories, package managers, container registries, and related security controls.
• Experience conducting architecture reviews, threat modeling, security assessments, and control design for modern application and cloud environments.
• Working knowledge of open source software, dependency risk, vulnerability management, licensing considerations, and secure development lifecycle practices.
• Ability to translate security requirements into scalable automation, developer workflows, and actionable engineering guidance.
• Strong communication, collaboration, technical leadership, and problem-solving skills.

Nice To Haves

• Hands-on experience with SBOM standards and tooling, SLSA-aligned provenance, attestations, artifact signing and verification, Sigstore or equivalent technologies, and OpenSSF guidance.
• Experience implementing SAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and policy-as-code in CI/CD workflows.
• Experience securing Git-based platforms, artifact managers, container registries, Kubernetes environments, build runners, and cloud-native delivery platforms.
• Knowledge of reproducible builds, dependency pinning, trusted build environments, secure package promotion, and Kubernetes admission controls.
• Familiarity with product and supply chain security guidance from OpenSSF, OWASP, NIST, CNCF, and related communities.
• Hands-on AI or machine learning development experience using Python and common frameworks or libraries for model integration, data processing, evaluation, or generative AI application development.
• Experience developing or integrating large language model applications, retrieval-augmented generation, embeddings, vector stores, agents, model APIs, or AI orchestration frameworks.
• Experience with AI development workflows and MLOps platforms, including model registries, experiment tracking, dataset and model versioning, automated evaluation, inference services, and runtime monitoring.
• Ability to create automated tests and security evaluations for AI-enabled applications, including adversarial inputs, prompt injection, data leakage, unsafe outputs, and tool or agent misuse.
• Experience applying software engineering and supply chain controls to AI artifacts, including models, datasets, prompts, notebooks, containers, and third-party AI components.
• Experience building security platforms, developer enablement capabilities, or enterprise guardrails with measurable adoption and risk-reduction outcomes.
• Open source contribution, security research, incident response, or technical community participation related to software supply chain security.

Responsibilities

• Design, build, implement, and operate security capabilities for source code, dependencies, build systems, CI/CD pipelines, artifact repositories, container registries, and production release workflows.
• Partner with product and platform engineering teams during architecture and design reviews to identify supply chain risks and define secure-by-design requirements.
• Develop reusable guardrails, reference implementations, libraries, policy-as-code, and pipeline integrations that make secure development practices easier to adopt.
• Automate SBOM generation and validation, dependency and container scanning, artifact signing and verification, build provenance, attestations, secrets detection, and release policy enforcement.
• Improve source control and build-environment security through branch protection, least-privilege access, credential protection, isolated and trusted runners, dependency pinning, and verified promotion paths.
• Assess risks including dependency confusion, typosquatting, malicious packages, compromised maintainers, poisoned base images, source or artifact tampering, credential theft, CI/CD runner compromise, and unauthorized releases.
• Evaluate and improve security controls for package managers, artifact repositories, container registries, Git-based development platforms, cloud-native environments, and third-party component intake.
• Triage software supply chain vulnerabilities and integrity events, support risk-based remediation, and help define scalable exception and escalation processes.
• Support incident response for compromised dependencies, repositories, build pipelines, credentials, artifacts, containers, models, and other supply chain components.
• Define and report measures of control adoption, coverage, effectiveness, vulnerability age, remediation performance, and policy compliance.
• Establish secure acquisition, development, storage, deployment, monitoring, and retirement practices for AI models, datasets, prompts, agents, and supporting services.
• Build prototypes, reference implementations, and automated security tests for AI-enabled applications using modern programming languages, AI/ML frameworks, model APIs, and orchestration libraries.
• Integrate security controls into AI development and MLOps workflows, including data preparation, model selection, prompt and agent development, evaluation, packaging, deployment, and runtime monitoring.
• Assess AI-enabled products for supply chain and product security risks, including model or data poisoning, insecure third-party services, prompt injection, sensitive-information disclosure, unsafe tool use, and unauthorized model or prompt changes.
• Provide guidance on open source, dataset, and model license obligations in partnership with legal and compliance stakeholders.
• Research emerging software and AI supply chain threats, apply relevant industry guidance, and contribute improvements to internal or open source security tooling where appropriate.
• Mentor engineers, lead complex technical initiatives, and influence product security and engineering strategy across the organization.

Benefits

• Competitive pay
• Benefits
• Flexibility to support well-being and future
• Personalized development programs
• Mentorship
• Certification assistance
• Employment authorization sponsorship may be considered for a new qualified applicant

What This Job Offers

• Job Type: Full-time
• Career Level: Senior