1 to 25 of 48 Permanent SBOM Jobs in the UK

service virtualisation and greater automation across complex engineering environments. Embed automated security controls including SAST, DAST, SCA, container/IaC scanning, secrets detection and SBOM generation into delivery pipelines. Establish policy-as-code, software supply chain security and automated compliance evidence, reducing manual controls and improving auditability. Define architecture ...

misconfiguration, identity exposure, and attack-path analysis using cloud-native tooling (AWS Inspector, GuardDuty, Security Hub, or equivalents). Experience securing software supply chains — SBOM generation, dependency provenance, artifact signing — and integrating this into build pipelines rather than a standalone assurance process. Experience building or shaping security engineering capability within ...

experience strongly preferred. You've designed CI/CD pipelines from scratch and implemented DevSecOps controls yourself, including secrets detection, dependency and container scanning, SBOM generation, and software supply-chain security. You use Python or Bash regularly and can demonstrate tooling you've developed and maintained. You understand observability, incident ...

Fluency with container security: image scanning, distroless/minimal base images, runtime security. Experience with software supply chain security tooling and frameworks (Sigstore, SLSA, SBOM generation). Solid understanding of OWASP, NIST, and cloud security frameworks and how to apply them pragmatically. If using AI for your resume or application ...

products in production Design and implement supply chain security controls across build and deployment pipelines, including artefact signing, provenance, dynamic admission controls and SBOM generation Requirements Strong engineering background, with experience building and shipping production systems Proven track record of building and scaling security programs Fluency in at least ...

Scripting: Python, Bash, or similar. Desirable Skills/Experience Familiarity with AI code generation tools and their security implications. Experience with supply chain security (SBOM, SLSA). CSSLP or equivalent certification. Deliver No PerformanceParameter Measure 1 Customer centricity Timely security breach solutioning to end users, Internal stakeholders & external customers experience ...

tracking through the security case and register. Secure Development & DevSecOps Integrate security into CI/CD pipelines (SAST, DAST, SCA, container/IaC scans, SBOM) and define release gates. Maintain security workflows and coach engineers on secure coding and threat‐driven design. Validation & Supplier Engagement Support V&V, penetration testing ...

/CD, Git integrations, and build tools Hands-on experience with application security, including Software Composition Analysis (SCA), code security, Software Bills of Materials (SBOM), or container security Experience building and managing software delivery pipelines using common development and DevOps tools Practical experience with at least one major cloud platform ...

/CD, Git integrations, and build tools Hands-on experience with application security, including Software Composition Analysis (SCA), code security, Software Bills of Materials (SBOM), or container security Experience building and managing software delivery pipelines using common development and DevOps tools Practical experience with at least one major cloud platform ...

traceability, and auditable artifact promotion across environments. integrate software composition analysis, open-source governance, and automated security gates into CI/CD pipelines. enable SBOM generation and validation, artifact signing, provenance verification and integrity controls. reduce supply-chain risk through dependency governance, approved-source policies, continuous monitoring, and remediation. partner ...

cloud and SaaS security best practices: least privilege, managed identities, secret management, network security, private endpoints, and secure software supply chain practices (image scanning, SBOM, dependency governance). Awareness of compliance, data residency and multi‐region considerations in multi‐tenant Azure environments. Technical leadership and communication Ability to run proofs ...

cloud and SaaS security best practices: least privilege, managed identities, secret management, network security, private endpoints, and secure software supply chain practices (image scanning, SBOM, dependency governance). Awareness of compliance, data residency and multi‐region considerations in multi‐tenant Azure environments. Technical leadership and communication Ability to run proofs ...

physical attack and tamper scenarios, firmware analysis, OT security principles, secure device provisioning and decommissioning. Supply Chain & ML Infrastructure : Dependency and container vulnerability management, SBOM generation and tracking, CVE triage and prioritisation, artifact signing and provenance, pipeline integrity, datacentre network segmentation, ML framework exposure, data flows between datacentre and cloud. ...

traceability, and auditable artifact promotion across environments. Integrate software composition analysis, open-source governance, and automated security gates into CI/CD pipelines. Enable SBOM generation and validation, artifact signing, provenance verification and integrity controls. Reduce supply-chain risk through dependency governance, approved-source policies, continuous monitoring, and remediation. Partner ...

expand commercial models. Things that we are proud of 2025 AI Compliance Solution of the Year - AI Breakthrough Awards 2025 DEVIES Award to our SBOM Manager new product for its innovation and impact in developer technology 2024 Industry Leader in Forrester-Wave for Software Composition Analysis (2024 Q4 report ...

supply chain. In an environment that relies heavily on automated coding agents, build systems that establish the provenance of code and dependencies: robust signing, SBOM generation (Sigstore, cosign), dependency and container scanning (Snyk, Trivy), and automated vulnerability management. Define agent sandboxing and least-privilege execution. Set and enforce the security … expect to run: model registries (MLflow, Weights & Biases); container and dependency scanners (Snyk, Trivy); policy-as-code (OPA); supply-chain tooling (Sigstore, cosign); and SBOM generators. Experience with model-weight handling and the classification of sensitive or dual-use research artefacts. A background that combines infrastructure engineering with security, from ...

functionality you develop Experience with interacting with backend APIs (REST, Websocket) An understanding of secure software development and maintaining software with a complex SBOM Great written and spoken English, including the ability to learn about and discuss complex architectures with other developers A basic foundational understanding of the networking protocols ...

platform engineering tools such as Crossplane for managing cloud infrastructure through Kubernetes Knowledge of software supply chain security concepts including software bill of materials (SBOM) and dependency governance Awareness of multi-region cloud architectures and their implications for consistent guardrails, compliance, and data residency Familiarity with the UK regulatory environment ...

across GitHub Actions and Azure Pipelines. Implement SAST, SCA, secrets scanning, container security and Infrastructure-as-Code scanning. Drive supply chain security initiatives including SBOM generation, artefact signing and policy enforcement. Harden AKS and cloud-native services through Infrastructure-as-Code and automated security controls. Work with engineering teams … Experience Multi-tenant SaaS platform environments. Microsoft Defender XDR suite. Building or transforming SOC functions. Threat hunting and purple team exercises. Supply chain security, SBOM, Sigstore, Cosign or SLSA frameworks. Policy as Code solutions such as OPA or Kyverno. Previous software engineering, platform engineering or infrastructure background. Certifications (Desirable) Certifications ...

At Campbell Scientific, we develop innovative measurement and monitoring solutions that help people understand and protect the world around us. From climate and environmental monitoring to renewable energy, infrastructure and scientific research, our technology supports ...

into environments with zero internet connectivity. Enforce Software Supply Chain Security: Implement cryptographic signing (e.g., Sigstore/Cosign, SLSA provenance), Software Bill of Materials (SBOM) generation, and automated vulnerability gating across all build pipelines. Automate Infrastructure-as-Code (IaC): Maintain release-side IaC and GitOps delivery frameworks (ArgoCD, Flux, Terraform … premise, edge, or air-gapped systems). Supply Chain Security Fluency: Solid understanding of build integrity concepts, artifact signing, provenance tracking, vulnerability scanning, and SBOM standards. CI/CD & GitOps Mastery: Proven experience designing enterprise pipelines (GitHub Actions, GitLab CI, Tekton, ArgoCD) with robust testing, canary/blue-green strategies ...

reduce dependency on scarce integrated environments. Security integration: Embed security controls into the pipeline: SAST, DAST, SCA, container and IaC scanning, secrets detection, and SBOM generation. Design the software supply chain security model — artefact provenance, signing, dependency governance, base image hardening. Define policy-as-code and automated control evidence …/k6, chaos and resilience tooling Security: SonarQube, Snyk, Checkmarx, Veracode, Trivy, secrets management (HashiCorp Vault, cloud-native equivalents), OPA/policy-as-code, SBOM and SLSA concepts. Platform: Kubernetes, containers, Terraform, service mesh, observability stacks AI/ML: MLOps and LLMOps tooling, model registries, vector stores and retrieval architectures ...

Pipelines: SAST, SCA, secrets, container and IaC scanning, with tuned rules, reusable pipeline templates and feedback developers can act on. Implement supply chain controls: SBOM generation, artifact signing and verification, dependency and base image policy, and the move from long‐lived pipeline secrets to OIDC federation. Harden … small team. Detection validation with purple teaming or Atomic Red Team, and hunting programmes that produced new detections. Supply chain security in depth: SBOM (CycloneDX or SPDX), Sigstore or cosign, and SLSA provenance. Policy as code with OPA or Kyverno. A background as a software or platform engineer before moving ...

Role: Full Stack Senior Developer Location: London Salary: Competitive salary and package dependant on experience Career Level: Manager (CL7) Please Note: Any offer of employment is subject to satisfactory BPSS and SC security clearance, which ...

prevent malware from entering the network, which provides us a unique opportunity to help build this inventory. Our team is responsible for: Providing SBOM tooling and helping integrate it into our supply chain Working across ecosystems to optimize our tooling for the best quality results Controlling and tracking the ingress ...