Staff Engineer, Software
As the world leader in serving science, our work is more than something that fills our days – what we do has great purpose. Our industry-leading scale means unparalleled commercial reach, unique customer access and a global footprint. Our broad customer base, from research to clinical to commercial production means you can have a broad and meaningful impact here at Thermo Fisher Scientific. All while working in an environment where you will be supported, valued and rewarded for your performance.
Staff Engineer, Software
Work Schedule
First Shift (Days)
Environmental Conditions
Office
Job Description
Thermo Fisher Scientific Inc. (NYSE: TMO) is the world leader in serving science, with revenues of more than $20 billion and approximately 65,000 employees globally. Our mission is to enable our customers to make the world healthier, cleaner and safer. We help our customers accelerate life sciences research, solve complex analytical challenges, improve patient diagnostics, deliver medicines to market and increase laboratory productivity. Through our premier brands – Thermo Scientific, Applied Biosystems, Invitrogen, Fisher Scientific and Unity Lab Services – we offer an unmatched combination of innovative technologies, purchasing convenience and comprehensive services
The Position
We are seeking a DevSecOps Engineer to integrate security practices into our DevOps processes, ensuring that applications and infrastructure are secure by design. This role focuses on embedding security controls across the CI/CD pipeline, enabling secure software delivery while maintaining development velocity.
You will work closely with development, QA, DevOps, and security teams to identify risks, implement automated security checks, and enforce best practices across the software development lifecycle. The role requires a proactive mindset to continuously improve security posture in complex, distributed environments
Key responsibilities include, but are not exclusively:
- Design, implement, and maintain secure CI/CD pipelines using Jenkins and GitLab, ensuring integration of security controls throughout the software delivery lifecycle
- Implement and manage automated SBOM generation (CycloneDX, SPDX) within CI/CD pipelines, ensuring accuracy and completeness of metadata
- Integrate SBOM data with vulnerability management platforms (e.g., Dependency-Track) to enable continuous monitoring of third-party risks
- Support compliance with cybersecurity regulations and standards (including Executive Order 14028), translating requirements into enforceable technical controls and preparation for EU CRA.
- Implement and manage vulnerability tracking and remediation workflows using tools such as DefectDojo
- Establish and enforce software supply chain security practices, including governance of third-party and open-source components
- Manage and maintain artifact repositories, ensuring proper classification of internal vs. external packages and secure usage of package sources (NuGet, Conan, Sky)
- Implement and enforce software license compliance, including automated license scanning and validation using SPDX identifiers
- Design and maintain secure, isolated, or controlled build environments to ensure integrity of the software build process
- Integrate static code analysis and security scanning tools (e.g.,SonarQube, TICS and CodeQL) into CI/CD pipelines
- Develop and maintain automation scripts (Python, PowerShell) to support security processes and pipeline efficiency
- Secure containerized environments (Docker, Kubernetes), including image hardening, access control (RBAC), and vulnerability scanning
- Collaborate with infrastructure teams to ensure VMware environments are hardened and aligned with security best practices
- Apply Secure Software Development Lifecycle (SSDLC) practices across development teams, embedding security early in the process
- Define, implement, and enforce security policies, standards, and compliance controls across development and DevOps workflows
- Collaborate closely with development, QA, and DevOps teams to remediate vulnerabilities and improve secure coding practices
- Support audit and compliance activities by maintaining documentation, traceability, and evidence in tools such as Confluence
- Proven experience in supporting teams performing OWASP threat modeling
- Participate in Agile processes using Jira, contributing to sprint planning, backlog refinement, and continuous improvement initiatives
- Perform risk assessments and proactively identify security gaps, proposing and implementing mitigation strategies
- Continuously improve DevSecOps tooling, processes, and practices to enhance security posture without impacting delivery speed
Requirements:
- The ideal candidate combines strong DevOps expertise with deep knowledge of application security,software supply chain security, and regulatory compliance, and thrives in complex, highly regulated environments.
- University degree in Computer Science, Cybersecurity, Software Engineering, or a related technical discipline
- 8+ years of Strong experience designing, implementing, and maintaining secure CI/CD pipelines using Jenkins and GitLab
- Mandatory hands-on experience implementing Software Bill of Materials (SBOM) generation within CI/CD pipelines (CycloneDX, SPDX formats), including metadata collection and validation
- Experience integrating SBOMs with vulnerability management platforms such as Dependency-Track or equivalent tools
- Hands-on experience with vulnerability management and tracking tools (e.g., DefectDojo or similar), including remediation workflows
- Strong understanding of software supply chain security, including governance of third-party and open-source components
- Experience managing artifact repositories and package ecosystems, including NuGet, Conan, and internal repositories (e.g., Sky), with clear understanding of internal vs. external package classification
- Strong knowledge of software license management, SPDX license identifiers, and automated license compliance enforcement
- Experience integrating static code analysis and security scanning tools (e.g., SonarQube, TICS, CodeQL) into CI/CD pipelines
- Hands-on experience designing and maintaining secure, isolated, or controlled build environments
- Strong scripting and automation skills using Python and/or PowerShell
- Experience securing containerized environments using Docker and Kubernetes, including image hardening, RBAC, and vulnerability scanning
- Strong understanding of VMware infrastructure security and system hardening best practices
- Solid understanding and practical application of Secure Software Development Lifecycle (SSDLC) principles
- Experience defining, implementing, and enforcing security policies, standards, and compliance controls across development and DevOps processes
- Experience supporting compliance with cybersecurity regulations and standards (e.g., Executive Order 14028, EU Cyber Resilience Act) and translating them into technical implementations
- Familiarity with OWASP practices, including supporting or contributing to threat modeling activities
- Experience working in audit-driven and regulated environments, with ability to produce documentation, traceability, and compliance evidence (e.g., via Confluence)
- Experience working in Agile environments using Jira, including Scrum, Kanban, and scaled Agile frameworks (ART)
- Strong analytical, risk assessment, and problem-solving skills, with the ability to identify vulnerabilities and propose effective mitigation strategies
- Proven ability to collaborate effectively with development, QA, DevOps, and infrastructure teams to drive secure development practices
- Strong communication skills, with the ability to translate security and regulatory requirements into actionable technical solutions
- Fluent in English (B2 level or higher)
