<div class="content-intro"><p class="font-claude-response-body break-words whitespace-normal leading-[1.7]"> </p> <p class="font-claude-response-body break-words whitespace-normal leading-[1.7]">Join New Era Technology, where People First is at the heart of everything we do. With a global team of over 3,000 professionals, we're committed to creating a workplace where everyone feels valued, empowered, and inspired to grow. Our mission is to securely connect people, places, and information with end-to-end technology solutions at scale.</p> <p class="font-claude-response-body break-words whitespace-normal leading-[1.7]">At New Era, you'll join a team-oriented culture that prioritizes your personal and professional development. Work alongside industry-certified experts, access continuous training, and enjoy competitive benefits. Guided by our core attributes — putting people first, embracing continuous learning, and thriving through collaboration and inclusion — we nurture our people to deliver exceptional customer service.</p> <p class="font-claude-response-body break-words whitespace-normal leading-[1.7]">If you want to make an impact in a supportive, growth-oriented environment, New Era is the place for you. Apply today and help us shape the future of work—together</p> <p> </p></div><p></p> <p data-pm-slice="1 1 []">SecureBlu by New Era Technology is looking for a hands-on DevSecOps Architect specializing in Software Supply Chain Security to help secure software build and release pipelines for our client, Commvault.</p> <p>The ideal candidate will have strong experience securing CI/CD pipelines, managing Software Bills of Materials (SBOMs), implementing artifact signing and provenance verification, and securing Kubernetes environments. This role focuses on hands-on implementation of security controls across the software development lifecycle.</p> <h3>Key Responsibilities</h3> <ul data-spread="false"> <li> <p>Design and implement software supply chain security controls across build and release pipelines.</p> </li> <li> <p>Secure GitHub and GitLab environments, including branch protection, signed commits, access controls, and provenance attestation.</p> </li> <li> <p>Implement SBOM generation, validation, and distribution using Syft, CycloneDX, or SPDX.</p> </li> <li> <p>Integrate dependency scanning and vulnerability management into CI/CD pipelines.</p> </li> <li> <p>Implement artifact signing and verification using Sigstore, Cosign, or in-toto.</p> </li> <li> <p>Develop and enforce security-as-code and policy-as-code controls using tools such as Open Policy Agent (OPA), Kyverno, or Conftest.</p> </li> <li> <p>Secure Kubernetes-based build and deployment environments.</p> </li> <li> <p>Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development workflows.</p> </li> <li> <p>Assess risks associated with open-source dependencies, AI-generated code, and AI coding assistants.</p> </li> <li> <p>Align security practices with SLSA, NIST SSDF, and NIST SP 800-218.</p> </li> <li> <p>Develop security documentation, reference architectures, runbooks, and audit evidence.</p> </li> <li> <p>Collaborate with security, engineering, platform, and compliance teams.</p> </li> </ul> <h3>Required Qualifications</h3> <ul data-spread="false"> <li> <p>5–8 years of experience in DevSecOps, application security, or platform engineering, with direct ownership of CI/CD security.</p> </li> <li> <p>Strong hands-on experience with GitHub Actions, GitLab pipelines, and enterprise-scale repository administration.</p> </li> <li> <p>Experience generating and managing SBOMs using SPDX or CycloneDX.</p> </li> <li> <p>Knowledge of SLSA, NIST SSDF, and NIST SP 800-218.</p> </li> <li> <p>Experience with artifact signing, provenance, and verification tools such as Sigstore, Cosign, or in-toto.</p> </li> <li> <p>Hands-on Kubernetes security experience, including admission control, network policies, and workload hardening.</p> </li> <li> <p>Experience with policy-as-code tools such as OPA, Kyverno, or Conftest.</p> </li> <li> <p>Understanding of threat modeling methodologies such as STRIDE or attack trees.</p> </li> <li> <p>Scripting proficiency in Python, Bash, or Go.</p> </li> <li> <p>Familiarity with Docker, OCI images, container registries, and container security.</p> </li> </ul> <h3>Preferred Qualifications</h3> <ul data-spread="false"> <li> <p>Experience with cloud platforms such as AWS, Azure, or Google Cloud.</p> </li> <li> <p>Familiarity with vulnerability management tools such as Snyk or Dependency-Track.</p> </li> <li> <p>Experience working in enterprise or regulated software environments.</p> </li> <li> <p>Previous consulting or contract experience supporting distributed engineering teams.</p> </li> </ul> <h3>Work Arrangement</h3> <ul data-spread="false"> <li> <p>Remote position.</p> </li> <li> <p>Regular overlap with US business hours is required for cross-team collaboration.</p> </li> <li> <p>No routine travel is identified.</p> </li> </ul> <p><strong>Education:</strong> Bachelor'