Open Source Software Senior Security Engineer - Software Supply Chain

The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status. Need Help? If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response). Regular or Temporary: Regular Language Fluency:  English (Required) Work Shift: 1st shift (United States of America) Please review the following job description: The Open Source Software (OSS) Senior Security Engineer owns the practical execution of open source software security across governance, engineering workflows, tooling, automation, and risk reduction. The role combines security program leadership with hands-on technical delivery to build secure-by-default OSS lifecycle capabilities and reduce software supply chain exposure. Responsibility for OSS security governance, software supply chain security, engineering enablement, CI/CD control integration, and proactive management of dependency, build, package, artifact, and provenance risks. The Open Source Software and Software Supply Chain Security Senior Engineer is responsible for defining and operating enterprise governance, standards, processes, and preventative controls that enable the secure use of open source software and reduce software supply chain risk across the software development lifecycle. This role partners closely with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure open source components, build pipelines, artifacts, package sources, and release processes are approved, continuously monitored, remediated, and safely integrated into enterprise applications and delivery pipelines. ESSENTIAL DUTIES AND RESPONSIBILITIES Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time. Governance and Standards: Define policies, standards, and control requirements for approved open source usage, dependency hygiene, SBOM generation, secure package sourcing, and software supply chain risk management. Secure OSS Lifecycle Management: Establish processes for OSS intake, approval, tracking, ownership, version management, vulnerability remediation, end-of-life component retirement, and exception governance. CI/CD Preventative Controls: Work with CI/CD and platform engineering teams to design and implement automated security gates for curated OSS usage, dependency scanning, license checks, artifact validation, provenance controls, build-time enforcement, and policy-based blocking of high-risk components. Software Supply Chain Risk Reduction: Identify and reduce risks related to vulnerable dependencies, malicious packages, dependency confusion, typosquatting, compromised maintainers, insecure build artifacts, and unauthorized package sources. Software Supply Chain Security: Establish controls for trusted package sources, dependency provenance, build integrity, artifact signing, repository hygiene, tamper resistance, and secure release practices. Threat Response and Incident Detection: Establish capabilities to rapidly identify, assess, and respond to open source supply chain threats, malicious package campaigns, zero-day vulnerabilities, compromised dependencies, and software supply chain security incidents. Tooling and Automation: Support the deployment, tuning, and integration of software composition analysis, SBOM, package repository, vulnerability management, and developer workflow tools. Risk Reporting and Metrics: Develop reporting that measures OSS risk posture, remediation velocity, policy exceptions, adoption of