Senior Security Software Engineer, Software Supply Chain Security

What you'll do

• Lead architecture and technical quality for software inventory, vulnerability intelligence, and related automation.
• Correlate software composition and vulnerability data, including end-of-life risk, into prioritized signals for engineering teams and security leadership.
• Set technical direction, mentor engineers, and help define secure development practices for AI-generated code and dependency choices.

What they ask for

• Hands-on experience in software supply chain security, dependency management, and open-source risk, with end-to-end ownership of a system or platform.
• Deep proficiency in Go and strong proficiency in Java, including Go Modules and Maven/Gradle.
• Experience with SBOM standards, software composition analysis tooling, and vulnerability data sources.
• Experience in technical leadership, software delivery pipelines, and cloud/container infrastructure; practical experience with AI coding assistants or agentic development tools.

Nice to have

• Familiarity with CycloneDX, SPDX, cdxgen, syft, Package URL (purl), OCI concepts, or SLSA and build/artifact attestations.
• Experience with graph-based dependency/risk modeling or automated dependency curation; familiarity with spec-driven development workflows.

Pay

$175,000 and $308,500 (base salary)

Tools

Go, Java, Go Modules, Maven/Gradle, NVD, OSV, GitHub Advisories, Kubernetes

AI focus

Use practical knowledge of AI coding assistants and agents to address AI-specific supply chain risks and help define secure development practices as AI-generated code and dependency choices increase.