DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

DevSecOps & Supply Chain Security Consultant - ( Onsite - Boston, MA)

We are looking to hire a candidate with the mentioned skill sets and experience for one of our clients,

Job Summary

We are seeking a DevSecOps & Supply Chain Security Consultant with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. The consultant will focus on secure SDLC, CI/CD pipeline architecture and security, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependency and secrets management, SAST/DAST, containers, IaC, vulnerability governance, and regulatory evidence.

The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions, remediation, release readiness, and residual risk and will produce audit-ready findings and stakeholder-ready reporting.

Work Authorization: Must be a US Citizen or Green Card holder (US Person) .

Travel: Up to three (3) weeks of travel to the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be arranged and covered. Travel may be a single visit or split across multiple visits based on project requirements.

Key Responsibilities

Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management.

Review SDLC processes, security tooling, and secure development practices.

Assess SCA, SBOM accuracy/completeness, dependency governance, and third-party risk.

Evaluate CI/CD pipeline security, artifact integrity, secure release controls, and build provenance.

Validate source-to-release traceability, artifact signing and promotion, tamper resistance, SBOM accuracy, security gates, exceptions, and remediation decisions.

Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls.

Evaluate Infrastructure-as-Code, pipeline-as-code, policy-as-code, and automated security-gate effectiveness.

Review secrets management across development, build, deployment, and operational environments.

Evaluate vulnerability management, remediation tracking, patch governance, EOL/EOS, and release-risk governance.

Assess signing-key, certificate, and HSM lifecycle controls.

Validate SBOM generation and binary-to-SBOM reconciliation.

Support lifecycle security assessments, compliance evidence mapping, and audit traceability.

Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, remediation guidance, and stakeholder-ready executive communication.

Recommend finding-specific follow-up work and support release governance reviews.

Required Skills / Experience

10+ years of experience in secure CI/CD pipeline setup, governance, and controls validation across different technology stacks.

2+ years of hands-on SBOM analysis experience .

Strong understanding of DevSecOps and secure software delivery practices .

Strong experience with SBOM frameworks: CycloneDX, SPDX, VEX/CSAF .

Experience with SCA, SAST, DAST, dependency scanning, and secrets scanning .

Experience with artifact integrity, artifact signing, verification, tamper testing, and build provenance .

Strong knowledge of CI/CD security, secure release governance, and automated security gates .

Experience with vulnerability management, remediation governance, dependency governance, and patch lifecycle management .

Experience with secrets management and secure release controls .

Knowledge of container, registry, build-agent, and CI/CD runner security .

Experience with Infrastructure-as-Code and pipeline-as-code security .

Knowledge of policy-as-code and security controls validation .

Experience with compliance evidence, audit traceability, and regulatory security assessments .

Knowledge of NIST SSDF and secure software supply-chain practices.

Experience with supplier security and software-acquisition assessments .

Hands-on experience with tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins, and Azure DevOps .

Experience with CRA / regulatory security assessments is highly preferred.

Familiarity with SLSA or modern software supply-chain security practices is a plus.

Experience with regulated products, export-controlled environments, or compliance-driven cybersecurity assessments is preferred.

Strong documentation and stakeholder communication skills.

Candidate needs to be US Citizen or Green Card holder.

Preferred Certifications

CSSLP

Certified DevSecOps Professional

Other relevant product-security credentials.

Location & Travel

Location: Boston, MA

On-site: Ability to work from the Boston office for 4–6 weeks during the engagement .

Travel: Up to 3 weeks at the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be covered.

Other Job Details:

Job Type: C2C or W2.

Location: Boston, MA, USA.

Interviews: Video interviews.

Docs required: ID proof will be required.