DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

We are looking to hire a candidate with the mentioned skill sets and experience for one of our clients, 

Job Summary

We are seeking a DevSecOps & Supply Chain Security Consultant with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. The consultant will focus on secure SDLC, CI/CD pipeline architecture and security, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependency and secrets management, SAST/DAST, containers, IaC, vulnerability governance, and regulatory evidence.

The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions, remediation, release readiness, and residual risk and will produce audit-ready findings and stakeholder-ready reporting.

Work Authorization: Must be a US Citizen or Green Card holder (US Person).

Travel: Up to three (3) weeks of travel to the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be arranged and covered. Travel may be a single visit or split across multiple visits based on project requirements.

Key Responsibilities

• Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management.
• Review SDLC processes, security tooling, and secure development practices.
• Assess SCA, SBOM accuracy/completeness, dependency governance, and third-party risk.
• Evaluate CI/CD pipeline security, artifact integrity, secure release controls, and build provenance.
• Validate source-to-release traceability, artifact signing and promotion, tamper resistance, SBOM accuracy, security gates, exceptions, and remediation decisions.
• Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls.
• Evaluate Infrastructure-as-Code, pipeline-as-code, policy-as-code, and automated security-gate effectiveness.
• Review secrets management across development, build, deployment, and operational environments.
• Evaluate vulnerability management, remediation tracking, patch governance, EOL/EOS, and release-risk governance.
• Assess signing-key, certificate, and HSM lifecycle controls.
• Validate SBOM generation and binary-to-SBOM reconciliation.
• Support lifecycle security assessments, compliance evidence mapping, and audit traceability.
• Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, remediation guidance, and stakeholder-ready executive communication.
• Recommend finding-specific follow-up work and support release governance reviews.

Required Skills / Experience

• 10+ years of experience in secure CI/CD pipeline setup, governance, and controls validation across different technology stacks.
• 2+ years of hands-on SBOM analysis experience.
• Strong understanding of DevSecOps and secure software delivery practices.
• Strong experience with SBOM frameworks: CycloneDX, SPDX, VEX/CSAF.
• Experience with SCA, SAST, DAST, dependency scanning, and secrets scanning.
• Experience with artifact integrity, artifact signing, verification, tamper testing, and build provenance.
• Strong knowledge of CI/CD security, secure release governance, and automated security gates.
• Experience with vulnerability management, remediation governance, dependency governance, and patch lifecycle management.
• Experience with secrets management and secure release controls.
• Knowledge of container, registry, build-agent, and CI/CD runner security.
• Experience with Infrastructure-as-Code and pipeline-as-code security.
• Knowledge of policy-as-code and security controls validation.
• Experience with compliance evidence, audit traceability, and regulatory security assessments.
• Knowledge of NIST SSDF and secure software supply-chain practices.
• Experience with supplier security and software-acquisition assessments.
• Hands-on experience with tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins, and Azure DevOps.
• Experience with CRA / regulatory security assessments is highly preferred.
• Familiarity with SLSA or modern software supply-chain security practices is a plus.
• Experience with regulated products, export-controlled environments, or compliance-driven cybersecurity assessments is preferred.
• Strong documentation and stakeholder communication skills.
• Candidate needs to be US Citizen or Green Card holder. 

Preferred Certifications

• CSSLP
• Certified DevSecOps Professional
• Other relevant product-security credentials.

Location & Travel

• Location: Boston, MA
• On-site: Ability to work from the Boston office for 4–6 weeks during the engagement.
• Travel: Up to 3 weeks at the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be covered. 

Other Job Details:

• Job Type: C2C or W2.
• Location:  Boston, MA, USA.
• Interviews: Video interviews.
• Docs required: ID proof will be required.