> Markdown version of [/jobs/ext/736434-senior-oss-sirt-engineer-technical-lead-hybrid](https://www.wearedevelopers.com/jobs/ext/736434-senior-oss-sirt-engineer-technical-lead-hybrid). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior OSS-SIRT Engineer / Technical Lead (Hybrid)

- **Company:** The Linux Foundation
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $140,000.0 - $160,000.0
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Computer Programming, Linux, Github, Python (Programming Language), Open Source Technology, Scripting, Code Inspection, Vulnerability Analysis
- **Published:** June 29, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=5a8663957969795d

## About the Role

Do you have experience in Vulnerability research?, * 8+ years in security engineering, PSIRT, or vulnerability research roles

 * Hands-on experience with OSS vulnerability disclosure and triage
 * Strong understanding of software supply chain security
 * Experience working directly with open source maintainers
 * Proficiency in scripting or programming (e.g., Python, Go), * Experience with OSV, GitHub Security Advisories, or CNA participation
 * Familiarity with SBOM tooling (SPDX, CycloneDX)
 * Automation-first security tooling development

Success Metrics (First 24 Months)

 * Stable, repeatable triage workflows operational within 3 months
 * Automation reducing manual review effort by 30% or more
 * High maintainer satisfaction and reduced back-and-forth on submissions
 * Successful mentorship of junior OSS-SIRT engineers, The Linux Foundation is unable to provide visa sponsorship for this position. Candidates must be authorized to work in their country of residence without employer sponsorship, now or in the future.

## Description

The Senior OSS-SIRT Engineer is the technical authority for vulnerability triage, tooling, workflows, and automation. This role bridges engineering, security analysis, and ecosystem operations, ensuring vulnerability data is accurate, machine-readable, and actionable. This individual acts as the day-to-day technical lead for OSS-SIRT operations and mentors junior engineers., * Lead vulnerability triage and validation using OSV-based workflows

 * Design and improve ingestion, linting, and curation pipelines
 * Coordinate with maintainers, researchers, and CNAs on complex disclosures
 * Develop and maintain automation tooling (APIs, CLIs, GitHub Actions, CI hooks)
 * Ensure alignment with OSV Schema, CWE, CVSS/EPSS, VEX, and SBOM formats
 * Support incident response for high-severity, multi-project vulnerabilities
 * Provide technical guidance to the OSS-SIRT Director on feasibility and risk


## Related Videos

- [Docker network without Docker](https://www.wearedevelopers.com/videos/1418-docker-network-without-docker)
- [Innovating Developer Tools with AI: Insights from GitHub Next](https://www.wearedevelopers.com/videos/1268-innovating-developer-tools-with-ai-insights-from-github-next)
- [JavaScript? No. Java Scripts! - Scripting with Java](https://www.wearedevelopers.com/videos/2094-javascript-no-java-scripts-scripting-with-java)
- [Surviving the Vulnpocalypse: Open Source and Supply Chain Security in a Post Mythos World](https://www.wearedevelopers.com/videos/100279-surviving-the-vulnpocalypse-open-source-and-supply-chain-security-in-a-post-mythos-world)
- [Docker exec without Docker](https://www.wearedevelopers.com/videos/1094-docker-exec-without-docker)
- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)

## Related Articles

- [The Future of Open Source: A Deep Dive - Scott Chacon at WeAreDevelopers World Congress 2024](https://www.wearedevelopers.com/magazine/471-the-future-of-open-source-a-deep-dive-scott-chacon-at-wearedevelopers-world-congress-2024)
- [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated)
- [Fully Remote Software Engineer Jobs](https://www.wearedevelopers.com/magazine/447-fully-remote-software-engineer-jobs)
- [Dev Digest 131 - AI'm not sure about OSS](https://www.wearedevelopers.com/magazine/472-dev-digest-131-ai-m-not-sure-about-oss)
- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)