6 of 6 Remote/Hybrid SLSA Jobs in the UK

chaos and resilience tooling Security: SonarQube, Snyk, Checkmarx, Veracode, Trivy, secrets management (HashiCorp Vault, cloud-native equivalents), OPA/policy-as-code, SBOM and SLSA concepts. Platform: Kubernetes, containers, Terraform, service mesh, observability stacks AI/ML: MLOps and LLMOps tooling, model registries, vector stores and retrieval architectures, evaluation frameworks ...

binary bundles) capable of deploying seamlessly into environments with zero internet connectivity. Enforce Software Supply Chain Security: Implement cryptographic signing (e.g., Sigstore/Cosign, SLSA provenance), Software Bill of Materials (SBOM) generation, and automated vulnerability gating across all build pipelines. Automate Infrastructure-as-Code (IaC): Maintain release-side ...

Atomic Red Team, and hunting programmes that produced new detections. Supply chain security in depth: SBOM (CycloneDX or SPDX), Sigstore or cosign, and SLSA provenance. Policy as code with OPA or Kyverno. A background as a software or platform engineer before moving into security. Qualifications and certifications: Certifications ...

Systematically, consistently and automatically capture the risk exposure of Chainguards products. Implement and enforce software supply chain security controls: signed artifacts, SBOMs, provenance attestation (SLSA, Sigstore/Cosign). Proactively identify emerging customer security needs, and build solutions to meet these. Lead security architecture reviews and threat models for Kubernetes … . Fluency with container security: image scanning, distroless/minimal base images, runtime security. Experience with software supply chain security tooling and frameworks (Sigstore, SLSA, SBOM generation). Solid understanding of OWASP, NIST, and cloud security frameworks and how to apply them pragmatically. If using AI for your resume ...

accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc). Store: Own the storage architecture for signed provenance metadata. Validate: Build the validation engine that verifies cryptographic … integrity and evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more. Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable. Collaborate: Work closely with product, customer ...

accepting provenance and attestation payloads from CI/CD systems, public registries, signed bundles, and customer-uploaded artifacts across a wide range of formats (SLSA, in-toto, SBOM attestations, Sigstore bundles etc). Store: Own the storage architecture for signed provenance metadata. Validate: Build the validation engine that verifies cryptographic … integrity and evaluates attestation data against configurable customer trust policies — SLSA level requirements, allowed builder identities, key material, and more. Expose: Deliver clean, well-documented APIs that make provenance data useful to customers and to other parts of the platform — queryable, auditable, and reliable. Collaborate: Work closely with product, customer ...