Software Supply Chain Security Engineer

State Street

Confirmed live yesterday High trust

Quick summary

Work type: On-site
Location: Quincy, MAToronto, Ontario, CanadaAustin, TXAtlanta, GAHong Kong, Hong Kong, China
Salary: $100,000–$167,500 / yr
Employment: Full-time
Posted: 38 days ago
Freshness: Confirmed live yesterday
Nearby: 99+ roles within 25 mi

Market check

Salary context

Below market

How this pay compares to similar roles

Similar $183k

This role $134k

$86k $234k

below market most similar roles pay here above market

This role pays less than 91% of similar roles. Most pay $150,375–$216,000 — the blue band above. At the midpoint, this role pays about $134k versus about $183k for comparable roles.

Based on 240 similar postings.

Employer

About State Street

State Street Corporation is one of the world''s largest custodian banks and asset managers, providing investment servicing, investment management, and investment research to institutional investors. Industry: Financial Services & Asset Custody

State Street currently has 330 open roles on FindRole.

Listed pay typically runs $120,000–$202,500 across 223 roles with salary data.

Most-posted roles

View all roles at State Street

At a glance

TL;DR · Software Supply Chain Security Engineer

Role Posting Log in to save

The Software Supply Chain Security Engineer joins the Cyber Security Architecture & Engineering team to execute a software supply chain security strategy. This role involves implementing DevSecOps and AppSec principles, automating security processes within CI/CD pipelines, and managing artifact caches like JFrog Artifactory. The engineer will partner with development leads to onboard teams to security tools, troubleshoot platform integrations, and maintain technical documentation. Key technical requirements include experience with Java, .Net, Python, and Node.js, alongside cloud technologies like Azure and AWS. Candidates should possess skills in Ansible, Terraform, Kubernetes, and Infrastructure as Code. The position focuses on securing open source artifacts, locking down artifact sourcing, and ensuring continuous security assessments across the enterprise using SLSA principles and various information security certifications.

Skills

AppSec DevSecOps Software Supply Chain Security CI/CD Java .Net Python Node.js AWS Azure Kubernetes Terraform Ansible JFrog Artifactory Maven Central PyPI SLSA Infrastructure as Code SSDLC

What you'll do

Execute the software supply chain security strategy to deploy secure-by-default open source artifacts.
Implement DevSecOps and AppSec principles and processes in partnership with Engineering team leads.
Onboard application teams to security tools and troubleshoot platform integrations with vendors.
Deliver and communicate security reporting via dashboards and metrics.
Develop and maintain comprehensive supply chain security and DevSecOps documentation.
Continuously improve DevSecOps and software supply chain security tools and processes.
Provide technical support to complete project tasks based on specific objectives.

What we're looking for

6+ years of relevant combined experience across development, CI/CD, software supply chain security and application security.
Proven expertise in application security (AppSec) and software supply chain security implementation and governance.
Experience in build and release management, secure software development lifecycle (SSDLC), and automating security processes within CI/CD pipelines.
Experience managing artifact caches like JFrog Artifactory and familiarity with package ecosystems like Maven Central and PyPI.
Experience with cloud technologies such as Azure and AWS.
Experience with automation and orchestration tools such as Ansible, Terraform, or Kubernetes (preferred).
Current information security certification, including CISSP (preferred).
Security+ or other cybersecurity security certification (preferred).

Save