DevSecOps & Supply Chain Security Consultant Onsite - Boston, MA)

Dev Sec Ops  & Supply Chain Security Consultant - (Onsite - Boston, MA)

We are looking to hire a candidate with the mentioned skill sets and experience for one of our clients,

We are seeking a Dev Sec Ops  & Supply Chain Security Consultant with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. The consultant will focus on secure SDLC, CI/CD pipeline architecture and security, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependency and secrets management, SAST/DAST, containers, IaC, vulnerability governance, and regulatory evidence.

The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions, remediation, release readiness, and residual risk and will produce audit-ready findings and stakeholder-ready reporting.

Must be a US Citizen or Green Card holder (US Person).

Up to three (3) weeks of travel to the client’s Tewksbury, MA site during the engagement. Travel and accommodation expenses will be arranged and covered. Travel may be a single visit or split across multiple visits based on project requirements.

• Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management.
• Review SDLC processes, security tooling, and secure development practices.
• Assess SCA, SBOM accuracy/completeness, dependency governance, and third-party risk.
• Evaluate CI/CD pipeline security, artifact integrity, secure release controls, and build provenance.
• Validate source-to-release traceability, artifact signing and promotion, tamper resistance, SBOM accuracy, security gates, exceptions, and remediation decisions.
• Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls.
• Evaluate Infrastructure-as-Code, pipeline-as-code, policy-as-code, and automated security-gate effectiveness.
• Review secrets management across development, build, deployment, and operational environments.
• Evaluate vulnerability management, remediation tracking, patch governance, EOL/EOS, and release-risk governance.
• Assess signing-key, certificate, and HSM lifecycle controls.
• Validate SBOM generation and binary-to-SBOM reconciliation.
• Support lifecycle security assessments, compliance evidence mapping, and audit traceability.
• Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, remediation guidance, and stakeholder-ready executive communication.
• Recommend finding-specific follow-up work and support release governance reviews.

• 10+ years of experience in secure CI/CD pipeline setup, governance, and controls validation across different technology stacks.
• 2+ years of hands-on SBOM analysis experience.
• Strong understanding of Dev Sec Ops  and secure software delivery practices.
• Strong experience with SBOM frameworks:
  CycloneDX, SPDX, VEX/CSAF.
• Experience with SCA, SAST, DAST, dependency scanning, and secrets scanning.
• Experience with artifact integrity, artifact signing, verification, tamper testing, and build provenance.
• Strong knowledge of CI/CD security, secure release governance, and automated security gates.
• Experience with vulnerability management, remediation governance, dependency governance, and patch lifecycle management.
• Experience with secrets management and secure release controls.
• Knowledge of container, registry, build-agent, and CI/CD runner security.
• Experience with Infrastructure-as-Code and pipeline-as-code security.
• Knowledge of policy-as-code and security controls validation.
• Experience with compliance evidence, audit traceability, and regulatory security…