Professional, Security Tool, SBOM Engineer

Zinnov is hiring for the role of Professional, Security Tool, SBOM Engineer on behalf of our Global MNC MedTech client company a company where technology sits at the centre of everything: powering how the core business operates day to day and shaping the products and digital solutions that will define the future of patient care. This role is part of the companys establishment of their new India Global Capability Centre (GCC) in Bengaluru which will drive enterprise technology, digital transformation and innovation for its global operations and contributing to technology that ultimately helps millions of people around the world.

How you'll make an impact

• Develop and operate SBOM generation and validation pipelines using SPDX and CycloneDX across applications, firmware, containers, and medical-device software.
• Integrate SCA/SBOM tooling such as Black Duck, Snyk, Mend, Sonatype Lifecycle, Anchore, Syft/Grype, Dependency-Track, Trivy, or equivalent into Jenkins, GitHub Actions, GitLab CI, or Azure DevOps.
• Establish standards for SBOM completeness, provenance, versioning, component identifiers, package URLs (purl), licensing, dependency relationships, and release traceability.
• Correlate component data with NVD, CISA KEV, vendor advisories, CVSS/EPSS, VEX/OpenVEX, and vulnerability-management platforms to prioritize actionable software risk.
• Support container/image, secrets, license, and supply-chain scanning and reduce false positives through tuning, suppression governance, and evidence-based validation.
• Automate ingestion and exchange of SBOM and vulnerability data through REST APIs, Python/Bash/PowerShell, artifact repositories, GRC, asset inventory, and product-security systems.
• Assess supplier-provided SBOMs, validate formats and component coverage, reconcile external inventories with internal scans, and track identified component risk.
• Support software-supply-chain integrity practices such as NIST SSDF, SLSA, signing/attestation concepts (for example Sigstore/cosign), and secure build controls where applicable.
• Produce dashboards, runbooks, architecture documentation, regulatory evidence, and coverage metrics aligned with FDA Section 524B, IEC 81001-5-1, and product-security requirements.

What you'll bring

Skills Required:

• 3+ years of Experience in application security, product security, DevSecOps, security-tool engineering, or software-supply-chain security with hands-on SBOM/SCA exposure.
• Strong working knowledge of SPDX, CycloneDX, SBOM lifecycle, SCA, CVE/CVSS, dependency management, open-source licensing, and software-component risk.
• Hands-on experience with at least one SCA/SBOM platform such as Black Duck, Snyk, Mend, Sonatype Lifecycle, Anchore, Dependency-Track, Syft/Grype, or equivalent.
• Experience integrating security scanning into CI/CD using Jenkins, GitHub Actions, GitLab CI, Azure DevOps, or equivalent pipeline technologies.
• Proficiency with Python, Bash, PowerShell, REST APIs, or comparable automation for data ingestion, validation, and tool integration.
• Familiarity with Docker, Kubernetes, artifact/package ecosystems, container scanning, and modern software build/release processes.
• Strong analytical, troubleshooting, documentation, data-quality, and cross-functional collaboration skills.
• Bachelor's degree in Computer Science, Software Engineering, Information Security, or a related technical field; equivalent practical experience may be considered.

Preferred:

• Experience in medical-device, healthcare, or life-sciences security with FDA Section 524B, IEC 81001-5-1, AAMI TIR57, and regulated software evidence.
• Experience with VEX/OpenVEX, SLSA, signing/attestation, supplier SBOM validation, GRC integration, or open-source license governance.
• CSSLP, GIAC GSSP/GWEB, Security+, DevSecOps, or software-supply-chain security certifications.