{"schemaVersion":"jobsearcher.job.v1","id":"b166081f1f33e01e42233c4e","url":"https://jobsearcher.com/jobs/b166081f1f33e01e42233c4e","canonicalUrl":"https://jobsearcher.com/jobs/b166081f1f33e01e42233c4e","title":"Open Source Software Security Engineer - Software Supply Chain","description":"The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.\n\nNeed Help?\n\nIf you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).\n\nRegular or Temporary:\n\nRegular\n\nLanguage Fluency: English (Required)\n\nWork Shift:\n\n1st shift (United States of America)\n\nPlease review the following job description:\n\nThe Open Source Software (OSS) Security Engineer owns the practical execution of open source software security across governance, engineering workflows, tooling, automation, and risk reduction. The role combines security program leadership with hands-on technical delivery to build secure-by-default OSS lifecycle capabilities and reduce software supply chain exposure.\n\nResponsibility for OSS security governance, software supply chain security, engineering enablement, CI/CD control integration, and proactive management of dependency, build, package, artifact, and provenance risks. The Open Source Software and Software Supply Chain Security Engineer is responsible for defining and operating enterprise governance, standards, processes, and preventative controls that enable the secure use of open source software and reduce software supply chain risk across the software development lifecycle. This role partners closely with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure open source components, build pipelines, artifacts, package sources, and release processes are approved, continuously monitored, remediated, and safely integrated into enterprise applications and delivery pipelines.\n\nESSENTIAL DUTIES AND RESPONSIBILITIES\nFollowing is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.\n\nGovernance and Standards: Define policies, standards, and control requirements for approved open source usage, dependency hygiene, SBOM generation, secure package sourcing, and software supply chain risk management.\nSecure OSS Lifecycle Management: Establish processes for OSS intake, approval, tracking, ownership, version management, vulnerability remediation, end-of-life component retirement, and exception governance.\nCI/CD Preventative Controls: Work with CI/CD and platform engineering teams to design and implement automated security gates for curated OSS usage, dependency scanning, license checks, artifact validation, provenance controls, build-time enforcement, and policy-based blocking of high-risk components.\nSoftware Supply Chain Risk Reduction: Identify and reduce risks related to vulnerable dependencies, malicious packages, dependency confusion, typosquatting, compromised maintainers, insecure build artifacts, and unauthorized package sources.\nSoftware Supply Chain Security: Establish controls for trusted package sources, dependency provenance, build integrity, artifact signing, repository hygiene, tamper resistance, and secure release practices.\nThreat Response and Incident Detection: Establish capabilities to rapidly identify, assess, and respond to open source supply chain threats, malicious package campaigns, zero-day vulnerabilities, compromised dependencies, and software supply chain security incidents.\nTooling and Automation: Support the deployment, tuning, and integration of software composition analysis, SBOM, package repository, vulnerability management, and developer workflow tools.\nRisk Reporting and Metrics: Develop reporting that measures OSS risk posture, remediation velocity, policy exceptions, adoption of preventative controls, and reduction of high-risk dependencies.\nDeveloper Enablement: Create guidance, playbooks, reusable patterns, and consultation models that help engineering teams make secure open source decisions early in the lifecycle.\n\nQualifications\nRequired Qualifications\nThe requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\n\nBachelor’s degree or equivalent education, training, and work-related experience.\nMinimum of 5 years of experience in security engineering or related cybersecurity roles.\nAdvanced knowledge in cybersecurity principles, theories, and concepts.\nProven experience in software development lifecycle security practices.\nAdvanced knowledge of threat modeling, security testing, and penetration testing.\nExperience implementing and managing complex information security technologies.\n\nPreferred Qualifications\n\nAdvanced cybersecurity certifications (e.g., CISSP, CISM, CEH, GIAC).\nExperience with security automation, orchestration, and advanced threat detection tools.\nFamiliarity with emerging cybersecurity technologies, industry trends, and strategic risk management.\nExperience in application security, software supply chain security, DevSecOps, vulnerability management, secure engineering, or related cybersecurity functions.\nStrong understanding of open source software governance, dependency management, SBOM, SCA, secure SDLC, CI/CD pipelines, and software supply chain threats.\nWorking knowledge of relevant security and software supply chain frameworks and standards, including OWASP, NIST Secure Software Development Framework (SSDF), Supply-chain Levels for Software Artifacts (SLSA), and related secure development guidance.\nExperience applying software supply chain security practices, including provenance, build integrity, artifact signing, secure package repositories, dependency trust, and CI/CD pipeline hardening.\nHands-on experience with CI/CD platforms, source code management, package managers, build systems, artifact repositories, and developer workflows.\nExperience with scripting or automation using languages such as Python, PowerShell, Bash, or similar.\nAbility to partner directly with engineering, platform, cloud, risk, audit, and compliance stakeholders to explain risk clearly and provide practical remediation guidance.\nAbility to translate technical risk into executive-ready reporting, measurable outcomes, and actionable remediation plans.\n\nThe annual base salary for this position is $105,000 - $130,000. Additional incentive pay is available for this position.\n\nGeneral Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist’s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.\n\nTruist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.\n\nEEO is the Law E-Verify IER Right to Work","company":"Truist","rawCompany":"truist","city":"Wilson","state":"NC","isRemote":false,"isActive":true,"createdAt":"2026-09-04T07:56:44.750Z","occupations":[{"code":"15-1252.00","title":"Software Developers","slug":"software-developers"},{"code":"15-1299.08","title":"Computer Systems Engineers/Architects","slug":"computer-systems-engineers-architects"},{"code":"15-1299.05","title":"Information Security Engineers","slug":"information-security-engineers"}],"industries":[{"code":"541512","title":"Computer Systems Design Services","slug":"computer-systems-design-services"},{"code":"513210","title":"Software Publishers","slug":"software-publishers"},{"code":"541511","title":"Custom Computer Programming Services","slug":"custom-computer-programming-services"}],"jobPosting":{"@context":"https://schema.org","@type":"JobPosting","title":"Open Source Software Security Engineer - Software Supply Chain","description":"The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.\n\nNeed Help?\n\nIf you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).\n\nRegular or Temporary:\n\nRegular\n\nLanguage Fluency: English (Required)\n\nWork Shift:\n\n1st shift (United States of America)\n\nPlease review the following job description:\n\nThe Open Source Software (OSS) Security Engineer owns the practical execution of open source software security across governance, engineering workflows, tooling, automation, and risk reduction. The role combines security program leadership with hands-on technical delivery to build secure-by-default OSS lifecycle capabilities and reduce software supply chain exposure.\n\nResponsibility for OSS security governance, software supply chain security, engineering enablement, CI/CD control integration, and proactive management of dependency, build, package, artifact, and provenance risks. The Open Source Software and Software Supply Chain Security Engineer is responsible for defining and operating enterprise governance, standards, processes, and preventative controls that enable the secure use of open source software and reduce software supply chain risk across the software development lifecycle. This role partners closely with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure open source components, build pipelines, artifacts, package sources, and release processes are approved, continuously monitored, remediated, and safely integrated into enterprise applications and delivery pipelines.\n\nESSENTIAL DUTIES AND RESPONSIBILITIES\nFollowing is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.\n\nGovernance and Standards: Define policies, standards, and control requirements for approved open source usage, dependency hygiene, SBOM generation, secure package sourcing, and software supply chain risk management.\nSecure OSS Lifecycle Management: Establish processes for OSS intake, approval, tracking, ownership, version management, vulnerability remediation, end-of-life component retirement, and exception governance.\nCI/CD Preventative Controls: Work with CI/CD and platform engineering teams to design and implement automated security gates for curated OSS usage, dependency scanning, license checks, artifact validation, provenance controls, build-time enforcement, and policy-based blocking of high-risk components.\nSoftware Supply Chain Risk Reduction: Identify and reduce risks related to vulnerable dependencies, malicious packages, dependency confusion, typosquatting, compromised maintainers, insecure build artifacts, and unauthorized package sources.\nSoftware Supply Chain Security: Establish controls for trusted package sources, dependency provenance, build integrity, artifact signing, repository hygiene, tamper resistance, and secure release practices.\nThreat Response and Incident Detection: Establish capabilities to rapidly identify, assess, and respond to open source supply chain threats, malicious package campaigns, zero-day vulnerabilities, compromised dependencies, and software supply chain security incidents.\nTooling and Automation: Support the deployment, tuning, and integration of software composition analysis, SBOM, package repository, vulnerability management, and developer workflow tools.\nRisk Reporting and Metrics: Develop reporting that measures OSS risk posture, remediation velocity, policy exceptions, adoption of preventative controls, and reduction of high-risk dependencies.\nDeveloper Enablement: Create guidance, playbooks, reusable patterns, and consultation models that help engineering teams make secure open source decisions early in the lifecycle.\n\nQualifications\nRequired Qualifications\nThe requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\n\nBachelor’s degree or equivalent education, training, and work-related experience.\nMinimum of 5 years of experience in security engineering or related cybersecurity roles.\nAdvanced knowledge in cybersecurity principles, theories, and concepts.\nProven experience in software development lifecycle security practices.\nAdvanced knowledge of threat modeling, security testing, and penetration testing.\nExperience implementing and managing complex information security technologies.\n\nPreferred Qualifications\n\nAdvanced cybersecurity certifications (e.g., CISSP, CISM, CEH, GIAC).\nExperience with security automation, orchestration, and advanced threat detection tools.\nFamiliarity with emerging cybersecurity technologies, industry trends, and strategic risk management.\nExperience in application security, software supply chain security, DevSecOps, vulnerability management, secure engineering, or related cybersecurity functions.\nStrong understanding of open source software governance, dependency management, SBOM, SCA, secure SDLC, CI/CD pipelines, and software supply chain threats.\nWorking knowledge of relevant security and software supply chain frameworks and standards, including OWASP, NIST Secure Software Development Framework (SSDF), Supply-chain Levels for Software Artifacts (SLSA), and related secure development guidance.\nExperience applying software supply chain security practices, including provenance, build integrity, artifact signing, secure package repositories, dependency trust, and CI/CD pipeline hardening.\nHands-on experience with CI/CD platforms, source code management, package managers, build systems, artifact repositories, and developer workflows.\nExperience with scripting or automation using languages such as Python, PowerShell, Bash, or similar.\nAbility to partner directly with engineering, platform, cloud, risk, audit, and compliance stakeholders to explain risk clearly and provide practical remediation guidance.\nAbility to translate technical risk into executive-ready reporting, measurable outcomes, and actionable remediation plans.\n\nThe annual base salary for this position is $105,000 - $130,000. Additional incentive pay is available for this position.\n\nGeneral Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist’s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.\n\nTruist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.\n\nEEO is the Law E-Verify IER Right to Work","datePosted":"2026-09-04T07:56:44.750Z","dateModified":"2026-09-04T07:56:44.750Z","hiringOrganization":{"@type":"Organization","name":"Truist","sameAs":"https://jobsearcher.com"},"jobLocation":{"@type":"Place","address":{"@type":"PostalAddress","addressLocality":"Wilson","addressRegion":"NC","addressCountry":"US"}},"identifier":{"@type":"PropertyValue","name":"JobSearcher","value":"b166081f1f33e01e42233c4e"},"url":"https://jobsearcher.com/jobs/b166081f1f33e01e42233c4e"}}