At a Glance
- Tasks: Design and build systems for software supply chain trust and provenance.
- Company: Fast-growing tech company focused on modern software delivery.
- Benefits: Equity, flexible working, health benefits, generous leave, and professional development support.
- Other info: Opportunity to influence critical product capabilities and work with cutting-edge technologies.
- Why this job: Make a real impact on software security and trust in a greenfield environment.
- Qualifications: Strong backend engineering experience and knowledge of software supply chains.
The predicted salary is between 63000 - 77000 £ per year.
- Principal Software Engineer, Supply Chain Security
- Artifact Provenance - SLSA - SBOMs - Cryptography - Greenfield Platform Engineering
Join a fast-growing, developer-first technology company building critical infrastructure for modern software delivery.
You will help create the next generation of software supply chain trust systems, giving organisations verifiable traceability from source code to built artifact and every downstream environment in which it is used.
The Role
As a Principal Software Engineer within the Supply Chain Trust team, you will design and build systems that capture, validate, store, and expose software build provenance.
This goes beyond identifying where an artifact came from.
Customers need to understand how it was built, what went into it, whether its provenance can be trusted, and where it was used across pipelines and deployments.
You will take substantial ownership of this greenfield capability, influencing its architecture, technical direction, engineering standards, and evolution into a secure product used by enterprise customers.
This is a product engineering role for someone with deep backend, platform, or security experience. It is not a pure Dev Ops or SRE position.
- What You Will Be Doing
- Designing and shipping provenance ingestion services for CI/CD systems, artifact registries, signed bundles, and customer-uploaded artifacts.
- Processing provenance and attestation formats including SLSA, in-toto, SBOM attestations, and Sigstore bundles.
- Designing storage models for signed metadata, artifact graphs, build relationships, and downstream usage.
- Building validation engines that verify cryptographic integrity and evaluate attestations against customer trust policies.
- Developing reliable APIs that make provenance data queryable, auditable, and useful.
- Solving high-volume ingestion, storage, performance, and schema-evolution challenges.
- Working with product, customer success, and engineering to turn enterprise security requirements into valuable product capabilities.
- Setting a high standard for security, correctness, observability, and technical decision-making.
- Mentoring engineers through design discussions, documentation, code reviews, and open collaboration.
- What You Need To Succeed
- Strong knowledge of artifact management, software supply chains, provenance, or build security.
- Practical familiarity with SLSA, in-toto, Sigstore, DSSE, SBOMs, SPDX, or Cyclone DX.
- An understanding of signing and verification, key material, ECDSA or RSA, certificate chains, keyless signing, and transparency logs.
- At least five years of production backend engineering experience.
- Evidence that you have built and owned complex product capabilities, rather than working exclusively in Dev Ops or SRE.
- Experience designing scalable ingestion pipelines for varied, high-volume, schema-evolving data.
- Strong data-modelling skills, particularly for metadata, graphs, and queryable relationships.
- Experience building and versioning APIs for enterprise customers or third-party integrations.
- Familiarity with multi-tenant Saa S systems, including isolation, access control, and auditability.
- Strong communication skills and the judgement to balance thoughtful architecture with iterative delivery.
Python is the preferred backend language, with AWS and Terraform used across the platform.
However, deep supply chain security expertise is more important than an exact technology match.
The Opportunity
You will work on a technically demanding problem at the centre of how software is built, secured, and delivered.
The role offers significant greenfield ownership, direct influence over a critical product capability, and the opportunity to help define how organisations establish trust across increasingly complex software supply chains.
The package includes equity, flexible UK working, comprehensive health and wellbeing benefits, generous annual leave, and dedicated support for professional development.
Applicants must be based in the UK and have the right to work independently without sponsorship.
#J-18808-Ljbffr
Principal Software Engineer (Supply Chain Security) employer: nineDots.io
At nineDots.io, we pride ourselves on being an excellent employer that fosters a collaborative and innovative work culture. Our fully remote setup allows for flexibility while providing competitive salaries and opportunities for professional growth in the dynamic field of finance and technology. Join us to be part of a small, expert team dedicated to pushing the boundaries of quantitative development and AI integration.
StudySmarter Expert Advice🤫
We think this is how you could land Principal Software Engineer (Supply Chain Security)
✨Join Local Tech Meetups
Get out there and mingle with fellow developers by joining local tech meetups. It’s a fantastic way to meet people who might be working at nineDots.io or know someone who does. Plus, you can pick up some trendy tech skills and trends while you're at it!
✨Contribute to Open Source Projects
Show off your coding chops by jumping into open-source projects. Not only does this give you practical experience, but it also gets you noticed in the dev community. You'll create a killer portfolio that speaks volumes about your skills to nineDots.io.
✨Tap into Online Developer Communities
Don’t underestimate the power of online developer communities like GitHub, Stack Overflow, and even Reddit. Participate in discussions, share your projects, and build your visibility. We can often find opportunities through these channels that can lead to a full-time gig at companies like nineDots.io.
✨Explore Job Boards Specifically for Tech Roles
Keep your eyes peeled on job boards that focus on tech roles. Sites like TechCareers or Stack Overflow Jobs can often have listings for companies like nineDots.io that might not show up on broader job sites. Make it a habit to check these regularly, and don’t hesitate to apply directly through our website!
We think you need these skills to ace Principal Software Engineer (Supply Chain Security)
Some tips for your application 🫡
Show off your coding skills:When applying for a software engineering role, it's super important to showcase your coding skills. Make sure your CV includes your tech stack, any relevant programming languages you’re comfortable with, and examples of projects you've worked on. If you have a GitHub profile, link it up! We love to see code in action.
Tailor your portfolio:For a full-time role, we’d expect to see some solid examples of your work in your portfolio. Make sure to include at least two or three projects that highlight your problem-solving skills and your ability to work with different technologies. Focus on the projects that are most relevant to the position at nineDots.io.
Craft a killer cover letter:Your cover letter is your chance to stand out—make it personal! Explain why you want to work at nineDots.io and how your skills align with the role. Show us your passion for software development. We dig enthusiastic candidates who understand the value of collaboration and continuous learning!
Be clear and concise:When it comes to writing your CV and cover letter, clarity is key. Avoid jargon that could confuse us and stick to simple, direct language. Highlight your achievements with quantifiable results where possible, and keep everything easy to read. A well-organised application goes a long way!
How to prepare for a job interview at nineDots.io
✨Brush Up on Your Coding Skills
For a full-time software engineering role, it's crucial that we stay sharp with our coding abilities. Expect technical questions that might involve solving problems on the spot or discussing algorithms. Practise on platforms like LeetCode or HackerRank to get comfortable with the types of questions that often come up.
✨Know Your Tools and Frameworks
Make sure we’re well-acquainted with the tools and technologies listed in the job description. Familiarise ourselves with any specific frameworks or programming languages mentioned. If nineDots.io uses React or Node.js, for instance, be ready to discuss how we’ve used them in previous projects or coursework.
✨Showcase Your Projects
Bring along a portfolio that highlights our best work. This could be code samples, GitHub repositories, or any side projects we’ve built. Make sure we can talk through our thought process for each project, especially the challenges we faced and how we solved them—this shows our problem-solving skills in action.
✨Prepare for Behavioural Questions
While technical skills are key, full-time positions also require cultural fit. Be ready to discuss our previous experiences and how we handle teamwork, conflict, and deadlines. Brush up on the STAR method—Situation, Task, Action, Result—to clearly articulate our past experiences when discussing how we've contributed to a team.
