Senior Engineer – Software Supply Chain Security

Why Join GEICO?

At GEICO, we offer a rewarding career where your ambitions are met with endless possibilities.

Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers' expectations while making a real impact on local communities nationwide.

Founded in 1936, GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company, we want you to feel valued, supported, and proud to work here. That's why we offer the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers.

GEICO is seeking a Senior Engineer – Software Supply Chain Security to advance the security of the systems, components, and processes used to build and deliver our products. In this role, you will design and operationalize controls that protect source code, dependencies, build environments, CI/CD pipelines, artifacts, containers, infrastructure-as-code, models, datasets, and third-party components. This includes extending software supply chain assurance to AI development and delivery by securing the sourcing, provenance, integrity, and lifecycle management of models, datasets, AI frameworks, and third-party AI services. You will partner with product, platform, and security engineering teams to make secure development practices easier to adopt through reusable guardrails, automation, and measurable assurance. Success in this role means engineering teams can securely consume software and AI components, build artifacts in trusted environments, verify provenance and integrity, identify risk early, and release products with confidence. 

Position Description: 

The Senior Engineer – Software Supply Chain Security is a hands-on product security engineering role responsible for reducing risk across the software development and delivery lifecycle. You will influence architecture, engineer security capabilities, integrate automated controls into developer workflows, and validate that those controls remain effective as platforms evolve. The role spans source control, dependency governance, trusted builds, artifact management, container security, release integrity, open source risk, and vulnerability remediation. You will extend these practices to AI-enabled products by securing the acquisition, development, versioning, packaging, deployment, and retirement of models, datasets, prompts, agents, and supporting services. This includes validating the provenance and integrity of AI artifacts, governing third-party models and AI dependencies, protecting model registries and data pipelines, and integrating security controls into AI development and MLOps workflows. You will help engineering teams address model and data tampering, compromised AI components, insecure integrations, and unauthorized changes while applying consistent software supply chain controls across traditional and AI-enabled products. Working across application development, platform engineering, cloud, data science, privacy, legal, risk, and incident response, you will translate security requirements into practical, developer-friendly solutions and help mature GEICO’s software supply chain security program. 

Position Responsibilities 

As a Senior Engineer, you will: 

• Design, build, implement, and operate security capabilities that protect source code, dependencies, build systems, CI/CD pipelines, artifact repositories, container registries, and production release workflows. 

• Partner with product and platform engineering teams during architecture and design reviews to identify software supply chain risks and define secure-by-design requirements. 

• Develop reusable guardrails, reference implementations, libraries, policy-as-code, and pipeline integrations that make secure development practices easy to adopt. 

• Automate software bill of materials generation and validation, dependency and container scanning, artifact signing and verification, build provenance, attestations, secrets detection, and release policy enforcement. 

• Improve the security of source control and build environments through controls such as branch protection, least-privilege access, credential protection, isolated and trusted runners, dependency pinning, and verified promotion paths. 

• Perform assessments for risks including dependency confusion, typosquatting, malicious packages, compromised maintainers, poisoned base images, source or artifact tampering, credential theft, CI/CD runner compromise, and unauthorized releases. 

• Evaluate and improve security controls for package managers, artifact repositories, container registries, Git-based development platforms, cloud-native environments, and third-party component intake. 

• Triage software supply chain vulnerabilities and integrity events, support product teams with risk-based remediation, and help define scalable exception and escalation processes. 

• Support incident response for compromised dependencies, repositories, build pipelines, credentials, artifacts, containers, models, and other supply chain components. 

• Define and report meaningful measures of control adoption, coverage, effectiveness, vulnerability age, remediation performance, and policy compliance. 

• Establish secure acquisition, development, storage, deployment, monitoring, and retirement practices for AI models, datasets, prompts, agents, and supporting services as an extension of the software supply chain program. 

• Build prototypes, reference implementations, and automated security tests for AI-enabled applications using modern programming languages, AI/ML frameworks, model APIs, and orchestration libraries. 

• Integrate security controls into AI development and MLOps workflows, including data preparation, model selection, prompt and agent development, evaluation, packaging, deployment, and runtime monitoring. 

• Assess AI-enabled products for supply chain and product security risks, including model or data poisoning, insecure third-party services, prompt injection, sensitive-information disclosure, unsafe tool use, and unauthorized model or prompt changes. 

• Provide guidance on open source, dataset, and model license obligations in partnership with legal and compliance stakeholders. 

• Research emerging software and AI supply chain threats, apply relevant industry guidance, and contribute improvements to internal or open source security tooling where appropriate. 

• Mentor engineers, lead complex technical initiatives, and influence product security and engineering strategy across the organization. 

Minimum Qualifications: 

• Bachelor’s degree in Computer Science, Information Systems, Cybersecurity, Engineering, or equivalent practical experience. 

• Professional software engineering, platform engineering, application security, or product security experience in enterprise or cloud-native environments. 

• Proficiency in at least one programming or scripting language such as Go, Rust, Java, C++, JavaScript, .NET, or Python. 

• Demonstrated experience with source code management, build systems, CI/CD pipelines, artifact repositories, package managers, container registries, and related security controls. 

• Experience conducting architecture reviews, threat modeling, security assessments, and control design for modern application and cloud environments. 

• Working knowledge of open source software, dependency risk, vulnerability management, licensing considerations, and secure development lifecycle practices. 

• Ability to translate security requirements into scalable automation, developer workflows, and actionable engineering guidance. 

• Strong communication, collaboration, technical leadership, and problem-solving skills. 

Preferred Qualifications: 

• Hands-on experience with SBOM standards and tooling, SLSA-aligned provenance, attestations, artifact signing and verification, Sigstore or equivalent technologies, and OpenSSF guidance. 

• Experience implementing SAST, software composition analysis, secrets scanning, container scanning, infrastructure-as-code scanning, and policy-as-code in CI/CD workflows. 

• Experience securing Git-based platforms, artifact managers, container registries, Kubernetes environments, build runners, and cloud-native delivery platforms. 

• Knowledge of reproducible builds, dependency pinning, trusted build environments, secure package promotion, and Kubernetes admission controls. 

• Familiarity with product and supply chain security guidance from OpenSSF, OWASP, NIST, CNCF, and related communities. 

• Hands-on AI or machine learning development experience using Python and common frameworks or libraries for model integration, data processing, evaluation, or generative AI application development. 

• Experience developing or integrating large language model applications, retrieval-augmented generation, embeddings, vector stores, agents, model APIs, or AI orchestration frameworks. 

• Experience with AI development workflows and MLOps platforms, including model registries, experiment tracking, dataset and model versioning, automated evaluation, inference services, and runtime monitoring. 

• Ability to create automated tests and security evaluations for AI-enabled applications, including adversarial inputs, prompt injection, data leakage, unsafe outputs, and tool or agent misuse. 

• Experience applying software engineering and supply chain controls to AI artifacts, including models, datasets, prompts, notebooks, containers, and third-party AI components. 

• Experience building security platforms, developer enablement capabilities, or enterprise guardrails with measurable adoption and risk-reduction outcomes. 

• Open source contribution, security research, incident response, or technical community participation related to software supply chain security.

Annual Salary

The above annual salary range is a general guideline. Multiple factors are taken into consideration to arrive at the final hourly rate/ annual salary to be offered to the selected candidate. Factors include, but are not limited to, the scope and responsibilities of the role, the selected candidate’s work experience, education and training, the work location as well as market and business considerations.

The GEICO Pledge:

Great Company: Protecting customers through life’s twists and turns with innovation and integrity.

Great Careers: Personalized development programs, mentorship, and certification assistance.

Great Culture: Inclusive and collaborative culture rooted in shared success.

Great Rewards: Competitive pay, benefits, and flexibility to support your well-being and future.

The equal employment opportunity policy of the GEICO Companies provides for a fair and equal employment opportunity for all associates and job applicants regardless of race, color, religious creed, national origin, ancestry, age, gender, pregnancy, sexual orientation, gender identity, marital status, familial status, disability or genetic information, in compliance with applicable federal, state and local law. GEICO hires and promotes individuals solely on the basis of their qualifications for the job to be filled.

GEICO reasonably accommodates qualified individuals with disabilities to enable them to receive equal employment opportunity and/or perform the essential functions of the job, unless the accommodation would impose an undue hardship to the Company. This applies to all applicants and associates. GEICO also provides a work environment in which each associate is able to be productive and work to the best of their ability. We do not condone or tolerate an atmosphere of intimidation or harassment. We expect and require the cooperation of all associates in maintaining an atmosphere free from discrimination and harassment with mutual respect by and for all associates and applicants.