DevSecOps SCA Engineer

About the role

Hewlett Packard Enterprise is seeking a DevSecOps SCA Engineer to lead the design, development, and maintenance of software solutions that enhance supply chain security. This hybrid position requires you to work on‑site two days a week, collaborating with engineering, security, and compliance teams to embed security controls throughout the CI/CD lifecycle.

Key responsibilities

• Design, develop, and maintain system software, utilities, and security tools.
• Build and operate automated pipelines that generate SBOMs (Software Bill of Materials) for both containerized and non‑containerized applications.
• Integrate Software Composition Analysis (SCA), dependency tracking, artifact signing, and other supply‑chain security controls into CI/CD pipelines.
• Define and enforce SBOM quality policies, format compliance (e.g., SPDX, CycloneDX), and attestations.
• Collaborate on vulnerability triage, exception handling, and audit readiness with cross‑functional teams.
• Write and execute comprehensive test plans, debug code, and resolve integration and security issues.
• Lead cross‑functional project teams, including internal and outsourced partners, to deliver reliable, cost‑effective solutions.
• Develop dashboards and reports to monitor supply‑chain posture, SLA adherence, and provide executive insights.

Required profile

• Advanced technical expertise in software development and security, with a focus on supply‑chain risk mitigation.
• Proven ability to lead projects, mentor junior staff, and make independent technical decisions.
• Strong collaboration skills to work with engineering, security, and compliance stakeholders.

Required skills

• SBOM generation and management (SPDX, CycloneDX)
• Software Composition Analysis (SCA) and dependency tracking
• Artifact signing and supply‑chain security controls
• CI/CD pipeline development and automation
• Vulnerability management and triage
• Containerized and non‑containerized application environments
• Dashboard and reporting creation for security metrics