Senior Cybersecurity Analyst

About the Role

We are seeking a Senior Cybersecurity Analyst to secure our software supply chain by assessing, governing, and mitigating risks associated with open-source software (OSS). This role partners closely with engineering, DevOps, and security teams to drive secure OSS adoption at scale.

What You’ll Do

• Generate and analyze SBOMs and conduct OSS security assessments using tools like Snyk and Syft.
• Evaluate and onboard security tools through proofs-of-concept (POCs).
• Build and operate cloud-based data pipelines to identify vulnerabilities, license risks, and supply chain threats.
• Develop dashboards and reports to communicate security risks to engineering teams and leadership.
• Design and integrate OSS security tooling, including JFrog Artifactory/Xray or Sonatype Nexus/Lifecycle.
• Partner with engineering teams to guide secure open-source usage and remediation.
• Support incident response efforts, including zero-day vulnerability management.
• Create OSS security standards, documentation, and training materials.

Experience You’ll Need

• 7+ years of experience in cybersecurity, application security, or software supply chain security.
• Hands-on experience with SBOMs, OSS scanning tools, and vulnerability management.
• Experience with JFrog or Sonatype artifact repository platforms.
• Strong background in cloud-native security and automation.

Skills & Technologies

• Programming: Python; npm / Node.js ecosystems
• Cloud & Platforms: AWS, Kubernetes, SQL
• OSS & Supply Chain: JFrog Artifactory/Xray, Sonatype Nexus/Lifecycle
• Reporting & Monitoring: Amazon QuickSight, Prometheus

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience).
• Knowledge of OWASP, NIST, and secure SDLC practices.
• Strong communication and cross-functional collaboration skills.
• Security certifications (CISSP, CSSLP, etc.) are a plus.
• Primary Qualifications: Python, AWS, Kubernetes, SQL, plus security certifications (CISSP, CSSLP, etc.)