DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

DevSecOps & Supply Chain Security Consultant - (Onsite - Boston, MA)

We are looking to hire a candidate with the mentioned skill sets and experience for one of our clients, 

Job Summary

We are seeking a DevSecOps & Supply Chain Security Consultant with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. The consultant will focus on secure SDLC, CI/CD pipeline architecture and security, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependency and secrets management, SAST/DAST, containers, IaC, vulnerability governance, and regulatory evidence.

The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions, remediation, release readiness, and residual risk and will produce audit-ready findings and stakeholder-ready reporting.

Work Authorization: Must be a US Citizen or Green Card holder (US Person).

Travel: Up to three (3) weeks of travel to the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be arranged and covered. Travel may be a single visit or split across multiple visits based on project requirements.

Key Responsibilities

• Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management.


• Review SDLC processes, security tooling, and secure development practices.


• Assess SCA, SBOM accuracy/completeness, dependency governance, and third-party risk.


• Evaluate CI/CD pipeline security, artifact integrity, secure release controls, and build provenance.


• Validate source-to-release traceability, artifact signing and promotion, tamper resistance, SBOM accuracy, security gates, exceptions, and remediation decisions.


• Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls.


• Evaluate Infrastructure-as-Code, pipeline-as-code, policy-as-code, and automated security-gate effectiveness.


• Review secrets management across development, build, deployment, and operational environments.


• Evaluate vulnerability management, remediation tracking, patch governance, EOL/EOS, and release-risk governance.


• Assess signing-key, certificate, and HSM lifecycle controls.


• Validate SBOM generation and binary-to-SBOM reconciliation.


• Support lifecycle security assessments, compliance evidence mapping, and audit traceability.


• Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, remediation guidance, and stakeholder-ready executive communication.


• Recommend finding-specific follow-up work and support release governance reviews.
  
  

Required Skills / Experience

• 10+ years of experience in secure CI/CD pipeline setup, governance, and controls validation across different technology stacks.


• 2+ years of hands-on SBOM analysis experience.


• Strong understanding of DevSecOps and secure software delivery practices.


• Strong experience with SBOM frameworks: CycloneDX, SPDX, VEX/CSAF.


• Experience with SCA, SAST, DAST, dependency scanning, and secrets scanning.


• Experience with artifact integrity, artifact signing, verification, tamper testing, and build provenance.


• Strong knowledge of CI/CD security, secure release governance, and automated security gates.


• Experience with vulnerability management, remediation governance, dependency governance, and patch lifecycle management.


• Experience with secrets management and secure release controls.


• Knowledge of container, registry, build-agent, and CI/CD runner security.


• Experience with Infrastructure-as-Code and pipeline-as-code security.


• Knowledge of policy-as-code and security controls validation.


• Experience with compliance evidence, audit traceability, and regulatory security assessments.


• Knowledge of NIST SSDF and secure software supply-chain practices.


• Experience with supplier security and software-acquisition assessments.


• Hands-on experience with tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins, and Azure DevOps.


• Experience with CRA / regulatory security assessments is highly preferred.


• Familiarity with SLSA or modern software supply-chain security practices is a plus.


• Experience with regulated products, export-controlled environments, or compliance-driven cybersecurity assessments is preferred.


• Strong documentation and stakeholder communication skills.


• Candidate needs to be US Citizen or Green Card holder. 
  
  

Preferred Certifications

• CSSLP


• Certified DevSecOps Professional


• Other relevant product-security credentials.
  
  

Location & Travel

• Location: Boston, MA


• On-site: Ability to work from the Boston office for 4–6 weeks during the engagement.


• Travel: Up to 3 weeks at the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be covered. 
  
  

Other Job Details:

• Job Type: C2C or W2.


• Location:  Boston, MA, USA.


• Interviews: Video interviews.


• Docs required: ID proof will be required.