Qualcomm
Senior SBOM Engineer
$118K–$177K
San Diego, California · On-site · Senior · Full-time · Posted Sep 18, 2026
- Experience
- 5+ years of related experience. The posting also lists minimum-qualification alternatives: bachelor's degree plus 2+ years of software engineering or related work experience; master's degree plus 1+ year; or a PhD. It separately asks for 2+ years of academic or work experience with a programming language.
- Education
- Bachelor's degree in Computer Science, Computer Engineering, or related technical field, or master's degree in an equivalent technical field.
About the job
Develops and scales open-source compliance and SBOM processes, tooling, and controls to help ensure secure and compliant software releases.
What you'll do
- Review open-source and third-party software, including licenses, dependencies, and distribution; generate and validate SBOMs.
- Build automation and integrate compliance controls into development, build, and CI/CD workflows.
- Partner with engineering, legal, security, and product teams on findings, releases, audits, and technical guidance.
What they ask for
- Bachelor's degree in Computer Science, Computer Engineering, or related technical field, or a master's degree in an equivalent technical field.
- 5+ years of software engineering, open source compliance, application security, DevSecOps, or related experience.
- Strong Linux and software development fundamentals; Git and modern source-control workflows.
- Proficiency in Python and experience with another language; experience with build systems, package management, SBOMs, and software composition analysis tools.
Nice to have
- Experience with SPDX, CycloneDX, VEX, or related standards; familiarity with Black Duck, FossID, ScanCode, ORT, Syft, or Snyk.
- Experience with containers, Kubernetes, cloud-native environments, or Linux, Android, embedded, or cloud-based products.
Pay
$117,800.00 - $176,600.00 USD base salary
Tools
Linux, Git, Python, C/C++, JavaScript, Go, Rust, Yocto, Gradle
Model-written summary · the original posting is authoritative