12 of 12 Permanent SLSA Jobs in the UK

immutable blobs, mutable metadata, package identity, checksums, upstream proxying, private repos, access control, caching, and promotion.Provenance and trust mechanisms such as SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery.Bonus PointsExperience securing artifact management, package registry, container registry, CI/CD, DevOps, developer tooling ...

blobs, mutable metadata, package identity, checksums, upstream proxying, private repos, access control, caching, and promotion. Provenance and trust mechanisms such as SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery. Bonus PointsExperience securing artifact management, package registry, container registry, CI/CD, DevOps, developer tooling ...

binary bundles) capable of deploying seamlessly into environments with zero internet connectivity. Enforce Software Supply Chain Security: Implement cryptographic signing (e.g., Sigstore/Cosign, SLSA provenance), Software Bill of Materials (SBOM) generation, and automated vulnerability gating across all build pipelines. Automate Infrastructure-as-Code (IaC): Maintain release-side ...

leaders on safe scaling patterns and reuse. Preferred qualifications, capabilities, and skills Advanced knowledge of CI/CD, application resiliency, and secure delivery (e.g., SLSA framework and GitOps). Deep experience with Observability and Monitoring tools (e.g., Prometheus, Grafana, OTEL). Expertise in performance optimisation of distributed systems (e.g., caching ...

influence senior technical leaders on safe scaling patterns and reuse.Preferred qualifications, capabilities, and skillsAdvanced knowledge ofCI/CD, application resiliency, and secure delivery (e.g., SLSA framework and GitOps).Deep experience with Observability and Monitoring tools (e.g., Prometheus, Grafana, OTEL).Expertise in performance optimisation of distributed systems (e.g., caching, network latency ...

technical leaders on safe scaling patterns and reuse. Preferred qualifications, capabilities, and skills Advanced knowledge ofCI/CD, application resiliency, and secure delivery (e.g., SLSA framework and GitOps). Deep experience with Observability and Monitoring tools (e.g., Prometheus, Grafana, OTEL). Expertise in performance optimisation of distributed systems (e.g., caching ...

technical leaders on safe scaling patterns and reuse. Preferred qualifications, capabilities, and skills Advanced knowledge ofCI/CD, application resiliency, and secure delivery (e.g., SLSA framework and GitOps). Deep experience with Observability and Monitoring tools (e.g., Prometheus, Grafana, OTEL). Expertise in performance optimisation of distributed systems (e.g., caching ...

platform security, DevSecOps, or engineering-led security teamsFamiliarity with security tools such as Snyk and WizKnowledge of software supply chain security concepts, including SBOM, SLSA, and dependency managementCloud certifications, preferably GCP (e.g., Professional Cloud Architect, Professional DevOps Engineer)Experience operating in large-scale enterprise environments within regulated industriesAbility to communicate ...

accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc).Store: Own the storage architecture for signed provenance metadata.Validate: Build the validation engine that verifies cryptographic integrity … evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more.Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable.Collaborate: Work closely with product, customer success, and the wider ...

accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc). Store: Own the storage architecture for signed provenance metadata. Validate: Build the validation engine that verifies cryptographic … integrity and evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more. Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable. Collaborate: Work closely with product, customer ...

quality complianceIntegrate with existing developer tooling to gather information and automateEnsuring the highest standards in security and supply chain integrity in-line with NIST, SLSA and other standardsDirect customer engagement to gather requirements and understand the disparate ways teams build software todayDeveloping supporting materials (software, training materials, workshops) to facilitate … Cloud ready tools like ArgoCD and Tekton a plusCloud (K8s and/or GCP) expertiseNice to haveUnderstanding of security concerns and frameworks such as SLSA and ensuring provenance of the SBOM a plusProven communication and influencing skills, experience coaching and mentoring a plusOtherLanguagesEnglish: B2 Upper IntermediateSeniorityLeadLondon, United Kingdom of Great ...

dependencies, build pipelines, and CI providers. You'll engineer the systems that make our supply chain defensible: provenance and integrity for what we build (SLSA, sigstore patterns, signed artifacts), dependency trust as a real control rather than a manifest scan, build-pipeline isolation, third-party risk as runtime telemetry. When … people around you Desirable Detection engineering at production scale: runtime detection, anomaly detection, alert tuning (Sigma, OSQuery, Falco, or equivalent) Supply-chain security: SLSA, sigstore/cosign, in-toto, SBOM tooling used as a real control Cloud-native attack patterns on AWS: IAM privilege analysis, IMDS exploitation, cross-account paths ...