6 of 6 Remote/Hybrid SLSA Jobs in the UK

Jenkins Shared Library powering multi-language builds (Java/Maven, Node/NPM, Python, Helm, Terraform, containers). Deliver fast, secure, provenance-rich pipelines (SLSA, SBOM, digests) and strengthen supplychain integrity across teams. Core Responsibilities : Design and maintain Groovy pipeline steps (build, test, package, scan, deploy). Extend Python tooling … for SLSA provenance, SBOM generation, hash/digest accuracy, and security scan aggregation (SonarQube, Sonatype IQ, SAST/Container). Optimize performance (parallel builds, caching, scope-reduced BOMs, dependency prefetch). Ensure artifact integrity (correct SHA1/SHA256 mapping, reproducible inputs, evidence modeling). Refactor legacy scripts (remove global state ...

immutable blobs, mutable metadata, package identity, checksums, upstream proxying, private repos, access control, caching, and promotion.Provenance and trust mechanisms such as SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery.Bonus PointsExperience securing artifact management, package registry, container registry, CI/CD, DevOps, developer tooling ...

blobs, mutable metadata, package identity, checksums, upstream proxying, private repos, access control, caching, and promotion. Provenance and trust mechanisms such as SBOMs, signing, attestations, SLSA, Sigstore, in-toto, trusted publishing, and zero-trust software delivery. Bonus PointsExperience securing artifact management, package registry, container registry, CI/CD, DevOps, developer tooling ...

binary bundles) capable of deploying seamlessly into environments with zero internet connectivity. Enforce Software Supply Chain Security: Implement cryptographic signing (e.g., Sigstore/Cosign, SLSA provenance), Software Bill of Materials (SBOM) generation, and automated vulnerability gating across all build pipelines. Automate Infrastructure-as-Code (IaC): Maintain release-side ...

accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc).Store: Own the storage architecture for signed provenance metadata.Validate: Build the validation engine that verifies cryptographic integrity … evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more.Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable.Collaborate: Work closely with product, customer success, and the wider ...

accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc). Store: Own the storage architecture for signed provenance metadata. Validate: Build the validation engine that verifies cryptographic … integrity and evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more. Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable. Collaborate: Work closely with product, customer ...