Senior Engineer – Software Supply Chain Security

Why Join GEICO

At GEICO we offer a rewarding career where your ambitions are met with endless possibilities.

Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers expectations while making a real impact on local communities nationwide.

Founded in 1936 GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company we want you to feel valued supported and proud to work here. Thats why we offer the GEICO Pledge: Great Company Great Culture Great Rewards and Great Careers.

GEICO is seeking a Senior Engineer Software Supply Chain Security to advance the security of the systems components and processes used to build and deliver our this role you will design and operationalize controls that protect source code dependencies build environments CI/CD pipelines artifacts containers infrastructure-as-code models datasets and third-party components. This includes extending software supply chain assurance to AI development and delivery by securing the sourcing provenance integrity and lifecycle management of models datasets AI frameworks and third-party AI services. You will partner with product platform and security engineering teams to make secure development practices easier to adopt through reusable guardrails automation and measurable assurance. Success in this role means engineering teams can securely consume software and AI components build artifacts in trusted environments verify provenance and integrity identify risk early and release products with confidence.

Position Description:

The Senior Engineer Software Supply Chain Security is a hands-on product security engineering role responsible for reducing risk across the software development and delivery lifecycle. You will influence architecture engineer security capabilities integrate automated controls into developer workflows and validate that those controls remain effective as platforms evolve. The role spans source control dependency governance trusted builds artifact management container security release integrity open source risk and vulnerability remediation. You will extend these practices to AI-enabled products by securing the acquisition development versioning packaging deployment and retirement of models datasets prompts agents and supporting services. This includes validating the provenance and integrity of AI artifacts governing third-party models and AI dependencies protecting model registries and data pipelines and integrating security controls into AI development and MLOps workflows. You will help engineering teams address model and data tampering compromised AI components insecure integrations and unauthorized changes while applying consistent software supply chain controls across traditional and AI-enabled products. Working across application development platform engineering cloud data science privacy legal risk and incident response you will translate security requirements into practical developer-friendly solutions and help mature GEICOs software supply chain security program.

Position Responsibilities

As a Senior Engineer you will:

• Design build implement and operate security capabilities that protect source code dependencies build systems CI/CD pipelines artifact repositories container registries and production release workflows.

• Partner with product and platform engineering teams during architecture and design reviews to identify software supply chain risks and define secure-by-design requirements.

• Develop reusable guardrails reference implementations libraries policy-as-code and pipeline integrations that make secure development practices easy to adopt.

• Automate software bill of materials generation and validation dependency and container scanning artifact signing and verification build provenance attestations secrets detection and release policy enforcement.

• Improve the security of source control and build environments through controls such as branch protection least-privilege access credential protection isolated and trusted runners dependency pinning and verified promotion paths.

• Perform assessments for risks including dependency confusion typosquatting malicious packages compromised maintainers poisoned base images source or artifact tampering credential theft CI/CD runner compromise and unauthorized releases.

• Evaluate and improve security controls for package managers artifact repositories container registries Git-based development platforms cloud-native environments and third-party component intake.

• Triage software supply chain vulnerabilities and integrity events support product teams with risk-based remediation and help define scalable exception and escalation processes.

• Support incident response for compromised dependencies repositories build pipelines credentials artifacts containers models and other supply chain components.

• Define and report meaningful measures of control adoption coverage effectiveness vulnerability age remediation performance and policy compliance.

• Establish secure acquisition development storage deployment monitoring and retirement practices for AI models datasets prompts agents and supporting services as an extension of the software supply chain program.

• Build prototypes reference implementations and automated security tests for AI-enabled applications using modern programming languages AI/ML frameworks model APIs and orchestration libraries.

• Integrate security controls into AI development and MLOps workflows including data preparation model selection prompt and agent development evaluation packaging deployment and runtime monitoring.

• Assess AI-enabled products for supply chain and product security risks including model or data poisoning insecure third-party services prompt injection sensitive-information disclosure unsafe tool use and unauthorized model or prompt changes.

• Provide guidance on open source dataset and model license obligations in partnership with legal and compliance stakeholders.

• Research emerging software and AI supply chain threats apply relevant industry guidance and contribute improvements to internal or open source security tooling where appropriate.

• Mentor engineers lead complex technical initiatives and influence product security and engineering strategy across the organization.

Minimum Qualifications:

• Bachelors degree in Computer Science Information Systems Cybersecurity Engineering or equivalent practical experience.

• Professional software engineering platform engineering application security or product security experience in enterprise or cloud-native environments.

• Proficiency in at least one programming or scripting language such as Go Rust Java C or Python.

• Demonstrated experience with source code management build systems CI/CD pipelines artifact repositories package managers container registries and related security controls.

• Experience conducting architecture reviews threat modeling security assessments and control design for modern application and cloud environments.

• Working knowledge of open source software dependency risk vulnerability management licensing considerations and secure development lifecycle practices.

• Ability to translate security requirements into scalable automation developer workflows and actionable engineering guidance.

• Strong communication collaboration technical leadership and problem-solving skills.

Preferred Qualifications:

• Hands-on experience with SBOM standards and tooling SLSA-aligned provenance attestations artifact signing and verification Sigstore or equivalent technologies and OpenSSF guidance.

• Experience implementing SAST software composition analysis secrets scanning container scanning infrastructure-as-code scanning and policy-as-code in CI/CD workflows.

• Experience securing Git-based platforms artifact managers container registries Kubernetes environments build runners and cloud-native delivery platforms.

• Knowledge of reproducible builds dependency pinning trusted build environments secure package promotion and Kubernetes admission controls.

• Familiarity with product and supply chain security guidance from OpenSSF OWASP NIST CNCF and related communities.

• Hands-on AI or machine learning development experience using Python and common frameworks or libraries for model integration data processing evaluation or generative AI application development.

• Experience developing or integrating large language model applications retrieval-augmented generation embeddings vector stores agents model APIs or AI orchestration frameworks.

• Experience with AI development workflows and MLOps platforms including model registries experiment tracking dataset and model versioning automated evaluation inference services and runtime monitoring.

• Ability to create automated tests and security evaluations for AI-enabled applications including adversarial inputs prompt injection data leakage unsafe outputs and tool or agent misuse.

• Experience applying software engineering and supply chain controls to AI artifacts including models datasets prompts notebooks containers and third-party AI components.

• Experience building security platforms developer enablement capabilities or enterprise guardrails with measurable adoption and risk-reduction outcomes.

• Open source contribution security research incident response or technical community participation related to software supply chain security.

Annual Salary

The above annual salary range is a general guideline. Multiple factors are taken into consideration to arrive at the final hourly rate/ annual salary to be offered to the selected candidate. Factors include but are not limited to the scope and responsibilities of the role the selected candidates work experience education and training the work location as well as market and business considerations.

The GEICO Pledge:

Great Company:Protecting customers through lifes twists and turns with innovation and integrity.

Great Careers:Personalized development programs mentorship and certification assistance.

Great Culture:Inclusive and collaborative culture rooted in shared success.

Great Rewards:Competitive pay benefits and flexibility to support your well-being and future.

The equal employment opportunity policy of the GEICO Companies provides for a fair and equal employment opportunity for all associates and job applicants regardless of race color religious creed national origin ancestry age gender pregnancy sexual orientation gender identity marital status familial status disability or genetic information in compliance with applicable federal state and local law. GEICO hires and promotes individuals solely on the basis of their qualifications for the job to be filled.

GEICO reasonably accommodates qualified individuals with disabilities to enable them to receive equal employment opportunity and/or perform the essential functions of the job unless the accommodation would impose an undue hardship to the Company. This applies to all applicants and associates. GEICO also provides a work environment in which each associate is able to be productive and work to the best of their ability. We do not condone or tolerate an atmosphere of intimidation or harassment. We expect and require the cooperation of all associates in maintaining an atmosphere free from discrimination and harassment with mutual respect by and for all associates and applicants.