Senior Python Engineer - Open Source Stewardship & Tooling

Job Description

A client of Insight Global is looking for a Senior Software Engineer. In this role, you will work as part of a team responsible for establishing the technical

stewardship capabilities required by the EU Cyber Resilience Act (CRA).

You will focus on developing the tooling and infrastructure necessary to generate comprehensive Software Bill of Materials (SBOMs) for critical open-source community

projects and integrating these manifests into Red Hat’s incident response workflows.

You will build automated solutions that bridge the gap between upstream project development and downstream security compliance, ensuring rapid detection of

vulnerabilities in open-source components. You will collaborate with internal security teams and external open-source communities to align on data standards and "secure by design" principles.

Primary Job Responsibilities

• Design and develop automated tooling to generate and maintain Software Bill

of Materials (SBOMs) for upstream open-source projects in standardized

machine-readable formats (, SPDX, CycloneDX).

systems to ensure real-time tracking of top-level and transitive dependencies,

including the generation of unique component identifiers (CPE, PURL).

Hat's Product Security Incident Response Team (PSIRT) tooling, enabling the

automatic mapping of new vulnerabilities (CVEs) to impacted upstream projects.

community projects to support transparency and automated vulnerability

handling requirements.

vulnerabilities in stewarded open-source components.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal opportunity / affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment regardless of their race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and / or a reasonable accommodation due to a disability during the application or recruiting process, please send a request to learn more about how we collect, keep, and process your private information, please review Insight Global's Workforce Privacy Policy :

Required Skills & Experience

Advanced (5+ years) knowledge of Python programming language and their

ecosystems.

SBOM standards (SPDX, CycloneDX) and vulnerability data formats (CSAF,

VEX, OSV).

for managing vulnerability and component metadata.

integrating security scanning tools into build processes.

collaborate in open-source communities

Benefit packages for this role will start on the 31st day of employment and include medical, dental, and vision insurance, as well as HSA, FSA, and DCFSA account options, and 401k retirement account access with employer matching. Employees in this role are also entitled to paid sick leave and / or other paid time off as provided by applicable law.