Senior Engineer – Software Supply Chain Security (AI)

Location: Bethesda, MD, United States. Full-time onsite role. hirify.global will consider sponsoring a new qualified applicant for employment authorization.

Salary: $100,000–$215,000 annual salary.

Company

hirify.global is a large United States auto insurer and a member of the Berkshire Hathaway family of companies, serving millions of customers nationwide.

What you will do

• Design, build, implement, and operate security capabilities for source code, dependencies, build systems, CI/CD pipelines, artifact repositories, container registries, and release workflows.
• Partner with product and platform engineering teams on architecture reviews, threat modeling, secure-by-design requirements, and risk-based remediation.
• Develop reusable guardrails, reference implementations, libraries, policy-as-code, pipeline integrations, automated security tests, and developer workflows.
• Automate SBOM generation and validation, dependency and container scanning, artifact signing and verification, build provenance, attestations, secrets detection, and release policy enforcement.
• Assess and respond to risks involving malicious packages, dependency confusion, poisoned images, tampering, compromised runners, credentials, repositories, artifacts, models, and unauthorized releases.
• Extend software supply chain security to AI and MLOps workflows, including model and dataset acquisition, versioning, packaging, deployment, monitoring, retirement, and third-party AI services.
• Define control metrics, support incident response, provide open-source and license guidance with legal and compliance stakeholders, research emerging threats, mentor engineers, and lead complex technical initiatives.

Requirements

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or equivalent practical experience.
• Professional experience in software engineering, platform engineering, application security, or product security in enterprise or cloud-native environments.
• Proficiency in at least one programming or scripting language such as Go, Rust, Java, C++, JavaScript, .NET, or Python.
• Experience with source code management, build systems, CI/CD pipelines, artifact repositories, package managers, container registries, and related security controls.
• Experience conducting architecture reviews, threat modeling, security assessments, and control design for modern application and cloud environments.
• Working knowledge of open-source software, dependency risk, vulnerability management, licensing considerations, and secure development lifecycle practices.
• Ability to translate security requirements into scalable automation, developer workflows, and actionable engineering guidance.
• Strong communication, collaboration, technical leadership, and problem-solving skills.

Nice to have

• Experience with SBOM standards and tooling, SLSA-aligned provenance, attestations, artifact signing and verification, Sigstore, and OpenSSF guidance.
• Experience implementing SAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and policy-as-code in CI/CD workflows.
• Experience securing Git-based platforms, artifact managers, container registries, Kubernetes environments, build runners, and cloud-native delivery platforms.
• Knowledge of reproducible builds, dependency pinning, trusted build environments, secure package promotion, and Kubernetes admission controls.
• Familiarity with OpenSSF, OWASP, NIST, CNCF, and related product and supply chain security guidance.
• Hands-on AI or machine learning development experience using Python and common frameworks for model integration, data processing, evaluation, or generative AI application development.
• Experience with large language model applications, retrieval-augmented generation, embeddings, vector stores, agents, model APIs, AI orchestration frameworks, and MLOps platforms.
• Experience creating automated tests and security evaluations for AI-enabled applications, including adversarial inputs, prompt injection, data leakage, unsafe outputs, and tool or agent misuse.
• Experience applying software engineering and supply chain controls to AI artifacts such as models, datasets, prompts, notebooks, containers, and third-party AI components.
• Experience building security platforms, developer enablement capabilities, or enterprise guardrails with measurable adoption and risk-reduction outcomes.
• Open-source contribution, security research, incident response, or technical community participation related to software supply chain security.

Culture & Benefits

• Inclusive and collaborative culture rooted in shared success.
• Personalized development programs, mentorship, and certification assistance.
• Competitive pay, benefits, and flexibility supporting employee well-being and long-term development.
• Work focused on protecting customers through innovation and integrity.