> Markdown version of [/jobs/ext/2721016-open-source-software-senior-security-engineer-software-supply-chain](https://www.wearedevelopers.com/jobs/ext/2721016-open-source-software-senior-security-engineer-software-supply-chain). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Open Source Software Senior Security Engineer - Software Supply Chain - **Company:** Truist Financial - **Location:** Charlotte, NC, United States - **Experience:** Expert - **Salary:** $140,000.0 - $180,000.0 - **Contract:** Temporary contract - **Skills:** Software System Penetration Testing, Bash Shell, Cloud Computing, Cyber Security, Continuous Integration, Intrusion Detection and Prevention, Python (Programming Language), Open Source Technology, Open Web Application Security, Package Management Systems, Windows PowerShell, Systems Development Life Cycle, Secure Coding, Software Engineering, Systems Integration, Software Vulnerability Management, Workflow Management Systems, Scripting, Enterprise Software Applications, Delivery Pipeline, Software Security, Free and Open-Source Software, Build Tools, Software Version Control, Devsecops, Security Orchestration, Automation & Response - **Published:** September 4, 2026 - **Apply:** http://hbcu.com/cgi-bin/jobs/searchJobs.cgi?job_id=35212146 ## About the Role The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions. * Bachelors degree or equivalent education, training, and work-related experience. * Minimum of 7 years of experience in security engineering or related cybersecurity roles. * Deep specialized knowledge in cybersecurity principles, theories, and concepts. * Proven experience in software development lifecycle security practices. * Deep knowledge of threat modeling, security testing, and penetration testing. * Experience implementing and managing complex information security technologies., * Advanced cybersecurity certifications (e.g., CISSP, CISM, CEH, GIAC). * Experience with security automation, orchestration, and advanced threat detection tools. * Familiarity with emerging cybersecurity technologies, industry trends, and strategic risk management. * Experience in application security, software supply chain security, DevSecOps, vulnerability management, secure engineering, or related cybersecurity functions. * Strong understanding of open source software governance, dependency management, SBOM, SCA, secure SDLC, CI/CD pipelines, and software supply chain threats. * Working knowledge of relevant security and software supply chain frameworks and standards, including OWASP, NIST Secure Software Development Framework (SSDF), Supply-chain Levels for Software Artifacts (SLSA), and related secure development guidance. * Experience applying software supply chain security practices, including provenance, build integrity, artifact signing, secure package repositories, dependency trust, and CI/CD pipeline hardening. * Hands-on experience with CI/CD platforms, source code management, package managers, build systems, artifact repositories, and developer workflows. * Experience with scripting or automation using languages such as Python, PowerShell, Bash, or similar. * Ability to partner directly with engineering, platform, cloud, risk, audit, and compliance stakeholders to explain risk clearly and provide practical remediation guidance. * Ability to translate technical risk into executive-ready reporting, measurable outcomes, and actionable remediation plans. ## Description The Open Source Software (OSS) Senior Security Engineer owns the practical execution of open source software security across governance, engineering workflows, tooling, automation, and risk reduction. The role combines security program leadership with hands-on technical delivery to build secure-by-default OSS lifecycle capabilities and reduce software supply chain exposure. Responsibility for OSS security governance, software supply chain security, engineering enablement, CI/CD control integration, and proactive management of dependency, build, package, artifact, and provenance risks. The Open Source Software and Software Supply Chain Security Senior Engineer is responsible for defining and operating enterprise governance, standards, processes, and preventative controls that enable the secure use of open source software and reduce software supply chain risk across the software development lifecycle. This role partners closely with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure open source components, build pipelines, artifacts, package sources, and release processes are approved, continuously monitored, remediated, and safely integrated into enterprise applications and delivery pipelines., Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time. * Governance and Standards: Define policies, standards, and control requirements for approved open source usage, dependency hygiene, SBOM generation, secure package sourcing, and software supply chain risk management. * Secure OSS Lifecycle Management: Establish processes for OSS intake, approval, tracking, ownership, version management, vulnerability remediation, end-of-life component retirement, and exception governance. * CI/CD Preventative Controls: Work with CI/CD and platform engineering teams to design and implement automated security gates for curated OSS usage, dependency scanning, license checks, artifact validation, provenance controls, build-time enforcement, and policy-based blocking of high-risk components. * Software Supply Chain Risk Reduction: Identify and reduce risks related to vulnerable dependencies, malicious packages, dependency confusion, typosquatting, compromised maintainers, insecure build artifacts, and unauthorized package sources. * Software Supply Chain Security: Establish controls for trusted package sources, dependency provenance, build integrity, artifact signing, repository hygiene, tamper resistance, and secure release practices. * Threat Response and Incident Detection: Establish capabilities to rapidly identify, assess, and respond to open source supply chain threats, malicious package campaigns, zero-day vulnerabilities, compromised dependencies, and software supply chain security incidents. * Tooling and Automation: Support the deployment, tuning, and integration of software composition analysis, SBOM, package repository, vulnerability management, and developer workflow tools. * Risk Reporting and Metrics: Develop reporting that measures OSS risk posture, remediation velocity, policy exceptions, adoption of preventative controls, and reduction of high-risk dependencies. * Developer Enablement: Create guidance, playbooks, reusable patterns, and consultation models that help engineering teams make secure open source decisions early in the lifecycle. ## Related Videos - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [DevSecOps: Injecting Security into Mobile CI/CD Pipelines](https://www.wearedevelopers.com/videos/273-devsecops-injecting-security-into-mobile-ci-cd-pipelines) - [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java) - [Old tools, new tricks](https://www.wearedevelopers.com/videos/1916-old-tools-new-tricks) - [DevSecOps culture](https://www.wearedevelopers.com/videos/783-devsecops-culture) - [DevSecOps: Security in DevOps](https://www.wearedevelopers.com/videos/36-devsecops-security-in-devops) ## Related Articles - [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks) - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Now is the time for industrialized software development](https://www.wearedevelopers.com/magazine/601-now-is-the-time-for-industrialized-software-development) - [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed) - [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)