Platform & Developer Experience
Release, Build & SDLC Engineer
The smallest archetype here, and the one whose future is being rewritten by regulation rather than by technology.
What the job actually is
You own the path from source to running artefact: pipelines, build reproducibility, artefact registries, versioning, and release mechanics. As a standalone title it has been shrinking for a decade, absorbed into platform teams — CI/CD appears in only 14% of postings and build systems in 5%.
Where it is regrowing is software supply-chain security. SBOMs, provenance attestation, signed artefacts, SLSA levels. That sits at 2% today, which is early — and early is exactly when a specialism is worth entering, since demand here is driven by procurement requirements and regulation rather than by engineering fashion.
Titles this hides behind
This is where the surviving "DevOps Engineer" postings concentrate at product companies.
Prepare like this
- Learn the supply-chain stack now — Sigstore, in-toto, SLSA levels, SBOM formats. Small investment, and it is the growth vector for this archetype.
- Understand build reproducibility and why it is hard: timestamps, paths, non-deterministic dependency resolution.
- Have a pipeline-speed story with numbers, and a rollback story where the rollback was the right call.
- Be able to threat-model a pipeline. Who can inject code, who holds signing keys, what a compromised runner reaches.
Be ready for
- "An attacker compromises one CI runner. What is the blast radius?" The question that connects this archetype to the security family.
- "How do you make a build reproducible, and how would you prove it?"
Compensation
A day that is actually representative
| Time | What you are actually doing |
|---|---|
| 09:00 | A pipeline that failed for an unrelated reason, again. |
| 11:00 | Build reproducibility work — chasing a timestamp that makes output differ. |
| 13:30 | Artefact signing and provenance. |
| 15:00 | A release with a rollback plan that has actually been tested. |
| 16:30 | Threat-modelling the pipeline itself. |
Real cases worth being able to discuss
Malicious code inserted into the build process of a widely-used product, distributed through legitimate signed updates.
Use it to say: “It is why build integrity and provenance are security controls, not release hygiene.”
A modified CI script exfiltrated credentials from thousands of pipelines.
Use it to say: “Anything the runner can read, an attacker who reaches the runner can read.”
An inconsistent deployment cost roughly $440m in 45 minutes.
Use it to say: “Deployment consistency is not a convenience; it is the control.”
A three-week plan
Week 1 — supply chain
Days 1–3: Sign an artefact, generate an SBOM, verify provenance.
Days 4–5: Read the SLSA levels and place your own pipeline honestly.
Week 2 — reproducibility
Days 1–5: Make one build reproducible and prove it with two independent builds.
Week 3 — rehearse
Days 1–3: The compromised-runner blast-radius answer.
Days 4–5: A pipeline-speed story and a rollback that was the right call.
The book for this field
SDLC, DevOps & Developer Experience
How software actually gets from a developer's machine to production: deployment strategies and the version-skew problem underneath them, infrastructure as code and the state file that runs everything, pipeline design that people do not route around, and the software supply chain link by link.
Cross-cutting
Skills every archetype tests
These are shared across every field on this site — the same question asked in different vocabulary — so preparation here compounds rather than being spent once. The book above is specific to your field.
Practice the 35 Platform questions → · Back to Platform & Developer Experience →