Platform & Developer Experience
6 · Release, Build & SDLC Engineer
The smallest archetype here, and the one whose future is being rewritten by regulation rather than by technology.
What the job actually is
You own the path from source to running artefact: pipelines, build reproducibility, artefact registries, versioning, and release mechanics. As a standalone title it has been shrinking for a decade, absorbed into platform teams — CI/CD appears in only 14% of postings and build systems in 5%.
Where it is regrowing is software supply-chain security. SBOMs, provenance attestation, signed artefacts, SLSA levels. That sits at 2% today, which is early — and early is exactly when a specialism is worth entering, since demand here is driven by procurement requirements and regulation rather than by engineering fashion.
Titles this hides behind
This is where the surviving "DevOps Engineer" postings concentrate at product companies.
Prepare like this
- Learn the supply-chain stack now — Sigstore, in-toto, SLSA levels, SBOM formats. Small investment, and it is the growth vector for this archetype.
- Understand build reproducibility and why it is hard: timestamps, paths, non-deterministic dependency resolution.
- Have a pipeline-speed story with numbers, and a rollback story where the rollback was the right call.
- Be able to threat-model a pipeline. Who can inject code, who holds signing keys, what a compromised runner reaches.
Be ready for
- "An attacker compromises one CI runner. What is the blast radius?" The question that connects this archetype to the security family.
- "How do you make a build reproducible, and how would you prove it?"
Compensation
What this role tests
Themes, and where to learn them
These chapters are shared across every role that tests them, so preparation here compounds rather than being spent once.
Practice questions across all themes → · Back to Platform & Developer Experience →