DevSecOps and Supply Chain Security Consultant

Job overview

The DevSecOps and Supply Chain Security Consultant role is onsite in Tewksbury, MA. Compensation is not specified. The consultant supports secure software delivery and software supply-chain security assessments. The role evaluates software development lifecycle practices, CI/CD controls, artifact integrity, SBOM governance, vulnerability management, and compliance evidence. It produces audit-ready findings and release-readiness and residual-risk conclusions to guide remediation and release governance.

What you'll do

• Assess software supply-chain security, SDLC maturity, SBOM governance, CI/CD controls, secrets management, auditability, and vulnerability management
• review development processes and tools
• evaluate dependency governance, artifact integrity, secure release controls, and remediation
• validate source-to-release traceability, build provenance, signing, security gates, and exceptions
• assess pipeline, container, registry, infrastructure-as-code, and policy-as-code security
• prepare audit-ready findings, remediation guidance, and release-readiness reporting.

What we're looking for

Skills & competencies

devsecops

supply chain security

tewksbury ma

zappsec

secure sdlc

ci/cd security

sbom

cyclonedx

spdx

artifact integrity

vulnerability management

release governance

us person

Work arrangement

• Weekend coverage required

Why this role

The posting seeks a US Person with 10+ years in secure CI/CD pipeline setup and governance and 2+ years of hands-on SBOM analysis experience.

About the employer

Zappsec Inc. is hiring for this role. Industry: All Other Professional, Scientific, and Technical Services. Sector: 54.