DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

DevSecOps & Supply Chain Security Consultant - ( Onsite - Boston, MA)

We are looking to hire a candidate with the mentioned skill sets and experience for one of our clients,

Job Summary

We are seeking a DevSecOps & Supply Chain Security Consultant with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. The consultant will focus on secure SDLC, CI/CD pipeline architecture and security, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependency and secrets management, SAST/DAST, containers, IaC, vulnerability governance, and regulatory evidence.

The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions, remediation, release readiness, and residual risk and will produce audit-ready findings and stakeholder-ready reporting.

Work Authorization: Must be a US Citizen or Green Card holder (US Person) .

Travel: Up to three (3) weeks of travel to the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be arranged and covered. Travel may be a single visit or split across multiple visits based on project requirements.

Key Responsibilities

- Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management.

- Review SDLC processes, security tooling, and secure development practices.

- Assess SCA, SBOM accuracy/completeness, dependency governance, and third-party risk.

- Evaluate CI/CD pipeline security, artifact integrity, secure release controls, and build provenance.

- Validate source-to-release traceability, artifact signing and promotion, tamper resistance, SBOM accuracy, security gates, exceptions, and remediation decisions.

- Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls.

- Evaluate Infrastructure-as-Code, pipeline-as-code, policy-as-code, and automated security-gate effectiveness.

- Review secrets management across development, build, deployment, and operational environments.

- Evaluate vulnerability management, remediation tracking, patch governance, EOL/EOS, and release-risk governance.

- Assess signing-key, certificate, and HSM lifecycle controls.

- Validate SBOM generation and binary-to-SBOM reconciliation.

- Support lifecycle security assessments, compliance evidence mapping, and audit traceability.

- Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, remediation guidance, and stakeholder-ready executive communication.

- Recommend finding-specific follow-up work and support release governance reviews.

Required Skills / Experience

- 10+ years of experience in secure CI/CD pipeline setup, governance, and controls validation across different technology stacks.

- 2+ years of hands-on SBOM analysis experience .

- Strong understanding of DevSecOps and secure software delivery practices .

- Strong experience with SBOM frameworks: CycloneDX, SPDX, VEX/CSAF .

- Experience with SCA, SAST, DAST, dependency scanning, and secrets scanning .

- Experience with artifact integrity, artifact signing, verification, tamper testing, and build provenance .

- Strong knowledge of CI/CD security, secure release governance, and automated security gates .

- Experience with vulnerability management, remediation governance, dependency governance, and patch lifecycle management .

- Experience with secrets management and secure release controls .

- Knowledge of container, registry, build-agent, and CI/CD runner security .

- Experience with Infrastructure-as-Code and pipeline-as-code security .

- Knowledge of policy-as-code and security controls validation .

- Experience with compliance evidence, audit traceability, and regulatory security assessments .

- Knowledge of NIST SSDF and secure software supply-chain practices.

- Experience with supplier security and software-acquisition assessments .

- Hands-on experience with tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins, and Azure DevOps .

- Experience with CRA / regulatory security assessments is highly preferred.

- Familiarity with SLSA or modern software supply-chain security practices is a plus.

- Experience with regulated products, export-controlled environments, or compliance-driven cybersecurity assessments is preferred.

- Strong documentation and stakeholder communication skills.

- Candidate needs to be US Citizen or Green Card holder.

Preferred Certifications

- CSSLP

- Certified DevSecOps Professional

- Other relevant product-security credentials.

Location & Travel

- Location: Boston, MA

- On-site: Ability to work from the Boston office for 4–6 weeks during the engagement .

- Travel: Up to 3 weeks at the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be covered.

Other Job Details:

- Job Type:  C2C or W2.

- Location:   Boston, MA, USA.

- Interviews:  Video interviews.

- Docs required:  ID proof will be required.