職種概要
We are looking for a Secure Build, Release & Supply-Chain Engineer to take complete ownership of software supply-chain integrity and secure release management across our engineering platforms. In this role, you will design and enforce reproducible builds, secure trusted package sources, manage private registries, generate and verify Software Bills of Materials (SBOMs), implement artifact signing and provenance, and establish policy gates for audit-ready artifact promotion and production releases.
必要条件
Must-Have Requirements
- 5+ years of experience in build and release engineering, DevSecOps, CI/CD platform engineering, or software supply-chain security.
- Build Systems & Compilation: Hands-on experience debugging and orchestrating multi-language compilation pipelines, dependency resolution, packaging systems, and reproducible builds.
- Registry & Package Management: In-depth experience administering and securing private artifact repositories and container registries (e.g., Harbor, Sonatype Nexus, JFrog Artifactory).
- Supply-Chain Controls: Practical expertise implementing SBOM generation and analysis, provenance tracking, vulnerability/secrets scanning, image signing, and verification gates.
- Core DevOps & Platform Fundamentals: Strong proficiency in Linux systems administration, advanced Git workflows, containerization (Docker), and CI/CD platforms (e.g., GitLab CI, Jenkins).
- Scripting & Automation: Strong scripting abilities in Python and Bash to build resilient release and verification automation.
Nice-to-Have Skills
- Security Frameworks: Practical knowledge of the SLSA (Supply-chain Levels for Software Artifacts) framework and implementing its requirements across build levels.
- Signing & Policy-as-Code: Direct experience with Cosign (Sigstore), Open Policy Agent (OPA), or Conftest for admission control and signature enforcement.
- Modern Container Build Tools: Experience with isolated, daemonless container build tools like BuildKit or Kaniko.
- Cloud-Native Delivery: Familiarity with Tekton pipelines, Kubernetes, Helm, and ArgoCD for declarative deployments.
- Secrets & Compliance: Experience integrating enterprise secrets management (e.g., HashiCorp Vault) and generating automated compliance/audit reports.
職務内容
- Supply-Chain Integrity & Attestation: Establish and enforce end-to-end software supply-chain controls, including generating cryptographic provenance (SLSA framework), producing comprehensive SBOMs, and implementing artifact signing.
- Build System & Pipeline Hardening: Architect reproducible build pipelines, isolate build environments using tools like BuildKit or Kaniko, and eliminate hidden compiler or environment assumptions across multi-language projects.
- Artifact Lifecycle & Promotion: Manage trusted package feeds, secure private artifact registries (Harbor, Nexus, Artifactory), and build automated, audit-ready promotion pipelines and release runbooks.
- Automated Policy Gates & Admission Controls: Implement automated verification mechanisms, static and vulnerability scanning (SCA, container, secrets), and admission policy enforcement to block unvetted or untrusted artifacts.
- Audit & Compliance Readiness: Maintain tamper-evident audit trails, artifact lineage records, and evidence generation workflows to satisfy compliance standards.
私たちが提供するもの
Empowering Projects: With 500+ clients spanning diverse industries and domains, we provide an exciting opportunity to contribute to groundbreaking projects that leverage cutting-edge technologies. As a team, we engineer digital products that positively impact people’s lives.
Empowering Growth: We foster a culture of continuous learning and professional development. Our dedication is to provide timely and comprehensive assistance for every consultant through our dedicated Learning & Development team, ensuring their continuous growth and success.
DE&I Matters: At GlobalLogic, we deeply value and embrace diversity. We are dedicated to providing equal opportunities for all individuals, fostering an inclusive and empowering work environment.
Career Development: Our corporate culture places a strong emphasis on career development, offering abundant opportunities for growth. Regular interactions with our teams ensure their engagement, motivation, and recognition. We empower our team members to pursue their career goals with confidence and enthusiasm.
Comprehensive Benefits: In addition to equitable compensation, we provide a comprehensive benefits package that prioritizes the overall well-being of our consultants. We genuinely care about their health and strive to create a positive work environment.
Flexible Opportunities: At GlobalLogic, we prioritize work-life balance by offering flexible opportunities tailored to your lifestyle. Explore relocation and rotation options for diverse cultural and professional experiences in different countries with our company.
GlobalLogicについて
GlobalLogic, a Hitachi Group Company, is a trusted digital engineering partner to the world’s largest and most forward-thinking companies. Since 2000, we’ve been at the forefront of the digital revolution – helping create some of the most innovative and widely used digital products and experiences. Today we continue to collaborate with clients in transforming businesses and redefining industries through intelligent products, platforms, and services.
