Platform Engineer with Nexus Repository and Sonatype

Responsibilities:

• Execute on enterprise software supply chain initiatives, supporting secure software delivery.
• Enhance Sonatype Repository artifact management, IQ firewall policy governance, open-source software lifecycle, and telemetry reporting.
• Implement software approval workflows, quarantine waiver, and lifecycle management processes.
• Coordinate dependency upgrades and vulnerability remediation workflows.
• Support onboarding of emerging ecosystems, including AI/ML frameworks.
• Develop reporting and metrics for software supply chain health, policy compliance, and repository utilization.
• Develop CI/CD artifact signing and verification capabilities for software builds.
• Implement SLSA build provenance and attestations across CI/CD platforms.
• Integrate SBOM generation and software metadata into build and deployment pipelines.

Required Technical Skills:

• 8+ years of Overall IT Exp.
• 3+ years of Platform Engineering, Software Supply Chain Engineering, or Open Source Governance experience.
• Hands-on experience with Sonatype Lifecycle (IQ Server) and Nexus Repository required.
• Experience creating and maintaining automated Open Source Software policies, workflows, and telemetry/reporting for component usage, licensing, and vulnerability tracking.
• Experience implementing artifact signing technologies (Sigstore/Cosign, GPG, Notary, etc.).
• Experience with SLSA provenance, in-toto attestations, or similar frameworks.
• Experience with SBOM generation (CycloneDX, SPDX, Syft).
• CI/CD experience with GitLab preferred (or comparable tooling, e.g. GitHub Actions).
• Strong AWS experience (IAM, ECS/EKS, EC2, S3, Lambda, Step Function, CloudWatch).
• Strong scripting skills (Python, Bash, or Go).

Familiarity with OCI registries and package ecosystems (Maven, npm, PyPI, NuGet).