DevOps / Build Infrastructure Engineer

Role Overview :

Owns the complete CI/CD pipeline and build infrastructure : build server provisioning, GitLab CI pipeline design and implementation, Yocto BitBake orchestration, post-build image integrity validation, firmware signing hook integration, SBOM generation, and vulnerability scanning.

Separate from Role A (BSP) Role E's focus is build automation and pipeline, not hardware bring-up. Role A provides Yocto layer expertise; Role E applies it to the pipeline.

Critical Skills (must-have) :

- CI/CD pipeline implementation : GitLab CI YAML authoring, pipeline stage design (build- validate- sign- test- promote), Docker/Podman container configuration.

- Yocto/BitBake build orchestration : BitBake invocation sequences, layer resolution order, sstate cache population, parallel build configuration, and image recipe selection working from the layer architecture Role A defines.

- Build artefact management : image output packaging, artefact archiving, post-build QEMU boot validation, and image integrity verification before test promotion.

- Firmware signing pipeline integration : signing hook design, development vs. release key management, integration with GitLab SVN handoff workflow.

- SBOM and vulnerability scanning : SPDX/CycloneDX SBOM generation, Grype/Trivy integration, CVE merge-gating configuration.

Optional / Preferred Skills :

- Jenkins or GitHub Actions experience in addition to GitLab CI.

- Kubernetes or container orchestration for distributed build farms.

- QEMU-based BMC emulation for pre-hardware build validation.

- Nix or Bazel build system experience.

- Linux security hardening for CI/CD build servers.

Educational Background :

Bachelor's degree in Computer Science, Software Engineering, or equivalent. Practical experience with CI/CD for embedded or firmware projects carries more weight than formal qualifications for this role.

Prior Work Experience Examples That Would Be Helpful :

- Built and maintained a GitLab CI (or equivalent) pipeline for a firmware or embedded Linux project, including automated build, post-build validation, and artefact signing stages.

- Configured a Yocto/BitBake build environment build server, Docker containers, sstate cache, shared downloads for a team of 3+ developers.

- Integrated SBOM generation and automated vulnerability scanning into a firmware CI/CD pipeline.

- Implemented a firmware image signing hook in a CI pipeline, including key management for development and release environments.