Software Supply Chain Engineer (f/m/x)
⚲ Warszawa, Białystok, Bydgoszcz, Kraków, Gdańsk, Katowice, Łódź, Lublin, Piła, Poznań
24 000 - 27 000 PLN netto (B2B)
Wymagania
- Open source
- CI/CD
- SBOM
- Dependency Management
- Linux
- CycloneDX
- Microsoft Windows
- Golang
- Syft
Opis stanowiska
We are looking for an experienced Software Supply Chain Engineer to join our InnerSource & Open Source Office (ISOSO). In this role, you will collaborate with software architects, developers, and cross-functional teams to ensure compliance with open source software usage in our commercial products. This remote position offers you the opportunity to strengthen our Software Supply Chain Compliance & Integrity team and contribute to regulatory compliance in a dynamic environment.
Your tasks
• Collaborating with software architects and senior developers to generate comprehensive Software Bills of Materials (SBOM) for commercial products, detailing open source components and dependencies
• Reviewing and analyzing the usage of open source software to ensure compliance with relevant regulations and licenses, considering deployment and architecture implications
• Integrating open source compliance checks into CI/CD pipelines to facilitate early identification of compliance issues and minimize risks
• Managing dependencies for at least two programming languages, such as .NET/C#, Python, Java, C/C++, or Node.JS/TypeScript, while considering both proprietary and open source components
• Creating and maintaining clear compliance documentation, including policies and best practices, to foster a compliant development environment
• Utilizing expertise in CycloneDX to enhance the accuracy and efficiency of compliance processes
• Staying informed about industry regulations, particularly FDA requirements, to ensure alignment with current and emerging standards
• Providing training and support to development teams on open source compliance practices, fostering a culture of awareness and responsibility
• Driving upstream contributions to Syft in Golang to enhance its capabilities in artifact analysis and supply chain security
Requirements
• Minimum 5 years of experience in software development with a strong focus on open source compliance
• Bachelor's degree in Computer Science, Software Engineering, or a related field
• Proven experience with CI/CD pipelines and integrating open source compliance checks into the development process
• Thorough understanding of open source licenses and best practices for compliance
• Demonstrable experience working with CycloneDX or similar SBOM formats
• Proficiency in managing dependencies across multiple programming languages such as .NET/C#, Python, Java, C/C++, Node.JS/TypeScript
• Familiarity with both Linux and Windows operating systems and their interactions with open source components
• Fluent English and Polish
• Residence in Poland
Nice-to-have requirements
• Experience in regulated industries such as healthcare or medical devices
• Knowledge of container and virtual machine technologies
• Deep familiarity with Golang and the Syft codebase is highly desired
Your tasks
• Collaborating with software architects and senior developers to generate comprehensive Software Bills of Materials (SBOM) for commercial products, detailing open source components and dependencies
• Reviewing and analyzing the usage of open source software to ensure compliance with relevant regulations and licenses, considering deployment and architecture implications
• Integrating open source compliance checks into CI/CD pipelines to facilitate early identification of compliance issues and minimize risks
• Managing dependencies for at least two programming languages, such as .NET/C#, Python, Java, C/C++, or Node.JS/TypeScript, while considering both proprietary and open source components
• Creating and maintaining clear compliance documentation, including policies and best practices, to foster a compliant development environment
• Utilizing expertise in CycloneDX to enhance the accuracy and efficiency of compliance processes
• Staying informed about industry regulations, particularly FDA requirements, to ensure alignment with current and emerging standards
• Providing training and support to development teams on open source compliance practices, fostering a culture of awareness and responsibility
• Driving upstream contributions to Syft in Golang to enhance its capabilities in artifact analysis and supply chain security
Requirements
• Minimum 5 years of experience in software development with a strong focus on open source compliance
• Bachelor's degree in Computer Science, Software Engineering, or a related field
• Proven experience with CI/CD pipelines and integrating open source compliance checks into the development process
• Thorough understanding of open source licenses and best practices for compliance
• Demonstrable experience working with CycloneDX or similar SBOM formats
• Proficiency in managing dependencies across multiple programming languages such as .NET/C#, Python, Java, C/C++, Node.JS/TypeScript
• Familiarity with both Linux and Windows operating systems and their interactions with open source components
• Fluent English and Polish
• Residence in Poland
Nice-to-have requirements
• Experience in regulated industries such as healthcare or medical devices
• Knowledge of container and virtual machine technologies
• Deep familiarity with Golang and the Syft codebase is highly desired
🔍 Dekoder Ogłoszenia
🔴
dynamicznym środowisku
Może oznaczać częste zmiany priorytetów, niepewność lub potrzebę szybkiego dostosowywania się do nowych sytuacji.
🔴
strengthen our Software Supply Chain Compliance & Integrity team
Sugeruje, że zespół może być w fazie budowania lub wymaga znaczącej poprawy, a nie jest już w pełni ukształtowany i efektywny.
🔴
collaborate with software architects and senior developers
Może oznaczać, że będziesz musiał przekonywać lub edukować bardziej doświadczonych inżynierów, którzy mogą nie być w pełni świadomi lub zaangażowani w kwestie zgodności.
🟡
at least two programming languages
Może oznaczać, że zakres obowiązków będzie szeroki i będzie wymagał od kandydata elastyczności w pracy z różnymi technologiami, potencjalnie wykraczającymi poza ścisłą specjalizację.