What are the responsibilities and job description for the DevSecOps & Supply Chain Security Consultant position at Arkhya Tech. Inc.?
Role: DevSecOps & Supply Chain Security Consultant
Work Location: Tewksbury, MA 01876 (Hybrid)
Contract
Role Summary
Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.
Key Responsibilities
- Review SDLC processes, tooling, and secure development practices
- Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk
- Evaluate CI/CD pipeline security, artifact integrity, and secure release controls
- Review secrets management across development, build, deployment, and operational environments
- Assess logging, auditability, and security event traceability controls
- Evaluate vulnerability management, remediation tracking, and patch governance processes
- Support lifecycle security assessment, compliance evidence mapping, and traceability
- Contribute to assessment reporting, remediation guidance, and release governance reviews
Required Skills & Experience
Mandatory:
- Strong understanding of DevSecOps and secure software delivery practices
- Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling
- Familiarity with CI/CD security controls and artifact integrity validation
- Experience with vulnerability management and dependency governance programs
- Understanding of lifecycle security, auditability, and compliance evidence requirements
- Experience with secrets management and secure release governance
Good to have:
- Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments
- Experience participating in engagement related to export-controlled environments
- Strong documentation skills
Preferred Certifications
- Kubernetes / Cloud Security certifications preferred
- DevSecOps or secure software supply chain experience preferred
- Familiarity with SLSA or modern software supply chain security practices
- Clearance / Compliance Requirements
Years of Required Experience
- 7-10 years in setting up, maintaining and controls validation of Secure. CI/CD pipelines across different type of tech stack.
- 2 Years experience with SBOM analysis