Full-Time

Associate Engineer

Lifecycle / Firewall

Posted on 7/19/2023

Sonatype

Sonatype

501-1,000 employees

OSS governance and security platform

No salary listed

Remote

Bachelor's, Master's, MBA, PharmD, PhD, Associate's

Category
Software Engineering
Required Skills
JavaScript
Java
HTML/CSS

Get referred to Sonatype

See people who can refer or advise you

Requirements
  • You have 0 to 2 years of work experience related to software development
  • Have an understanding of Java
  • You are familiar with front-end development, such as JavaScript, HTML, and CSS
  • You are familiar with relational databases
  • Basic knowledge of SaaS and cloud technologies
  • Passionate about lifelong learning
  • Reside in Colombia
Responsibilities
  • You have foundational knowledge in software engineering and would like to expand your skill set in quality, testing, debugging, design, and security
  • You are motivated by the opportunity to contribute to improving the Software Supply Chain
  • You will be a member of the Sonatype Lifecycle or Sonatype Repository Firewall
  • You will collaborate with your primary team on projects and other Sonatype product teams

Sonatype focuses on helping organizations manage and secure their use of open-source software. Its Nexus Platform automates DevOps workflows and governs open-source usage, covering the software supply chain from building and storing artifacts to checking for security defects across the SDLC. Its OSS Edition offers free artifact management, while paid offerings like Nexus Repository Manager Professional and Nexus Lifecycle add high-availability, security defect detection, and risk elimination features. The company differentiates itself by specializing in open-source governance and software security across the entire development lifecycle, serving IT leaders, developers, and industries such as healthcare. Its goal is to enable safe, efficient, and compliant use of open-source software to improve software quality and security.

Company Size

501-1,000

Company Stage

Growth Equity (Venture Capital)

Total Funding

$154.7M

Headquarters

Fulton, Missouri

Founded

2008

Get referred to Sonatype

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • June 2026 leadership hires strengthen revenue, marketing, and people operations for scale.
  • Nexus Repository Cloud launched October 2025, unlocking SaaS expansion and AWS Marketplace reach.
  • Vertosoft distribution expands Sonatype's public-sector channel across federal procurement networks.

What critics are saying

  • AI-assisted attacks are rising; Sonatype tracked 1,346,867 malicious packages through Q1 2026.
  • Flooding Dropper hit npm in August 2026, exposing Sonatype customers to live threats.
  • JFrog and Snyk pressure Sonatype on platform breadth, pricing, and enterprise renewals.

What makes Sonatype unique

  • Sonatype stewards Maven Central and Nexus Repository, giving unmatched supply-chain visibility.
  • Gartner named Sonatype a 2026 Leader in software supply chain security.
  • Sonatype Guide embeds MCP controls into GitHub Copilot, Cursor, and Amazon Kiro.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Distributed Workforce - Walls don’t make a company great, people do — and we have the best. While we have offices in the US in Maryland and Virginia, and also in London and Sydney, our growing and talented team lives and works anywhere and everywhere.

Mission Driven - We’re helping software developers harness the power of open source, while making software safer. What does that mean for you? An opportunity to join a smart, mission-oriented team that is changing how software is made.

Competitive Salary & Benefits - We believe in taking care of our team. That means more than just interesting work — it's great benefits, competitive compensation packages, flexible schedules, and an endless opportunity to learn and grow.

Open, Transparent, Diverse - Our varied experiences, locations, ethnicities, genders, and sexual orientations, make us a better company. That's why we're committed to bringing different backgrounds and perspectives into our organization.

Growth & Insights and Company News

Headcount

6 month growth

-1%

1 year growth

-1%

2 year growth

1%
Business Upturn
Jul 29th, 2026
Sonatype and Forrester address the growing ai-era Software Supply Chain Risk facing Indian enterprises in the guru forum.

Sonatype and Forrester address the growing ai-era Software Supply Chain Risk facing Indian enterprises in the guru forum. -Advertisement- Discover more Research from Sonatype and Forrester examines how AI is driving precision software supply chain attacks - and what this means for software governance, enterprise resilience, and responsible AI adoption across highly regulated industries. HYDERABAD, India, July 29, 2026 /PRNewswire/ - Sonatype(R), the company helping enterprises accelerate agentic software development with confidence, is bringing together technology, cybersecurity, and business leaders in India in association with Forrester to examine how artificial intelligence is reshaping software supply chain risk - and what enterprises must do to respond. The discussion is informed by Sonatype's latest research, The Trust Economy of Software: How AI is Reshaping Software Supply Chain Risk for Financial Services. Based on an analysis of 9,747 verified malicious package advisories between January 2020 and May 2026, along with enterprise telemetry from the financial services sector, the study reveals a fundamental change in attacker behaviour. Software supply chain attacks are no longer driven primarily by scale. Attackers are increasingly using precision campaigns designed to impersonate trusted software, target developers, and influence component-selection decisions before code reaches production. The implications are especially significant for India, one of the world's fastest-growing software development hubs and a global centre for financial technology, digital engineering, and Global Capability Centres. As Indian enterprises and GCCs expand their use of open-source software, third-party components, and AI-assisted development, the ability to govern what enters the software lifecycle is becoming a strategic business priority. "AI is helping development teams assemble software faster, but it is also accelerating the number of decisions they make about what software to trust. Attackers understand that shift. They are no longer relying only on scale; they are investing in precision attacks that look familiar, targeting developers directly, and executing before traditional controls have a chance to intervene. For Indian enterprises and GCCs, the priority is not to slow AI adoption. It is to establish trusted governance at the point where software enters development," said Abhishek Chauhan, Senior Director of Technology and India Country Head, Sonatype. Sonatype's research found: * Targeted malicious package advisories increased 75-fold in two years, rising from 28 in 2023 to 1,576 in 2025. * 47% of malicious packages now impersonate trusted software, using familiar names, integrations, and utilities to appear legitimate. * 53% of malicious packages analysed in 2025 targeted developers during installation, before traditional security controls could intervene. * More than one in four malicious package advisories now uses advanced techniques, including obfuscation, multi-stage droppers, and backdoors. The findings highlight the need for enterprises to move beyond reactive vulnerability management by ensuring security begins before a component enters the build, not after it reaches production. Speaking at the event was Ashutosh Sharma, VP, Principal Analyst, Forrester. Software development is entering a new phase as AI changes not only how code is written, but also how software components are discovered, selected, and integrated. As organizations accelerate AI adoption, governance must evolve alongside development practices. Understanding how software trust is established and how software supply chain risks are changing will become increasingly important for organizations seeking to balance innovation with resilience. For India's financial institutions, digital-native enterprises, and GCCs, the opportunity is clear: lead the next phase of AI-driven software development by governing software assembly with the same speed and discipline with which it is being created. As open-source and AI-assisted workflows become central to innovation, software confidence must move beyond compliance to become a source of competitive advantage - enabling faster delivery, stronger resilience, and more trustworthy AI adoption. About Sonatype: Sonatype is the company that accelerates agentic software development with confidence. Trusted by thousands of enterprises and millions of developers, Sonatype helps organizations govern the open-source, AI-generated, and third-party components that power modern software. As the steward of Maven Central and the company behind Nexus Repository, Sonatype provides unmatched visibility into how software is built, consumed, and secured - helping teams move faster, reduce risk, and ship software with confidence at AI scale. To learn more, visit www.sonatype.com About Forrester: Forrester (Nasdaq: FORR) is one of the most influential research and advisory firms in the world. We empower leaders in technology, customer experience, digital, marketing, sales, and product functions to be bold at work and accelerate growth through customer obsession. Our unique research and continuous guidance model help executives and their teams achieve their initiatives and outcomes faster and with confidence. To learn more, visit www.Forrester.com View original content to download multimedia:https://www.prnewswire.com/in/news-releases/sonatype-and-forrester-address-the-growing-ai-era-software-supply-chain-risk-facing-indian-enterprises-in-the-guru-forum-302837277.html Disclaimer: The above press release comes to you under an arrangement with PR Newswire. Business Upturn takes no editorial responsibility for the same. -Advertisement-

Associated Press
Jun 9th, 2026
Sonatype appoints three executives to scale AI-driven software development growth

Sonatype has appointed three executives to lead its expansion in AI-driven software development. Casey Watson joins as chief revenue officer, Jason McClelland as chief marketing officer, and Sherri Manning as chief human resources officer. Watson brings over 30 years of IT experience, most recently serving as SVP of Sales for North America at OneTrust, with previous roles at VMware Tanzu and Docker. McClelland arrives from positions at Salesforce, Adobe and DataStax, whilst Manning comes from Olo, where she served as chief people officer. The appointments support Sonatype's growth strategy as demand increases for secure, AI-driven software development. The company, which operates Maven Central and Nexus Repository, helps organisations manage open source, AI-generated and third-party software components.

Alabama Business Reporter
Jun 9th, 2026
Sonatype names three industry veterans to executive team to lead the next chapter of agentic development.

Sonatype names three industry veterans to executive team to lead the next chapter of agentic development. New leaders bring deep expertise in scaling organizations and strengthening market leadership growth amid accelerating demand for secure, AI-driven software development. Fulton, Md., June 09, 2026 (GLOBE NEWSWIRE) - Sonatype(R), the company that accelerates agentic software development with confidence, today announced the appointments of Casey Watson as Chief Revenue Officer (CRO), Jason McClelland as Chief Marketing Officer (CMO), and Sherri Manning as Chief Human Resources Officer (CHRO). These appointments come at a pivotal moment for Sonatype as the company scales its go-to-market, revenue, and people strategies to meet growing enterprise demand for secure, AI-driven software development. "Sonatype is operating at the intersection of three of the most important forces in technology today: AI, open source, and cybersecurity," said Bhagwat Swaroop, CEO of Sonatype. "Casey, Jason, and Sherri bring the experience and leadership we need to scale growth, lead our marketing initiatives, and continue building a high-performance culture that matches the pace of AI." Watson brings more than three decades of IT experience across software engineering and senior sales leadership, with a track record of building high-performing teams in complex, high-growth technology organizations. Most recently SVP of Sales for North America at OneTrust, he previously held leadership roles at VMware Tanzu, R3, Siemplify, and Docker. As CRO, Watson will lead Sonatype's global revenue strategy and go-to-market execution, aligning pre- and post-sales efforts to create a more cohesive customer journey. "Organizations today are under increasing pressure to innovate faster while maintaining trust and security across the software supply chain," said Casey Watson, CRO at Sonatype. "Sonatype is uniquely positioned to help customers meet that challenge, and I'm energized by the opportunity to work alongside this talented team to strengthen our customer partnerships, align our go-to-market efforts, and help organizations innovate securely at scale." McClelland joins Sonatype with a track record of creating new categories and leading growth at global enterprise companies, including Salesforce, Adobe, Heroku, and DataStax, with extensive experience in scaling both emerging and legacy technologies to achieve strategic goals. As CMO, he will focus on advancing Sonatype's AI and agentic initiatives to meet evolving customer needs in a dynamic landscape. "I came to Sonatype because I believe this organization holds the critical intelligence required for developers to code quickly and safely with AI," said Jason McClelland, CMO at Sonatype. "Software developers are at the forefront of a dynamic, progressively opaque development ecosystem that is in the midst of upheaval. I'm excited to help build on the legacy of Nexus Repository and Maven Central and support Sonatype by ushering in a new era of developer enablement that starts with foundational control." Manning brings nearly three decades of experience building strong, trusting, and empathetic cultures while scaling global teams at high-growth organizations. Manning comes to Sonatype from Olo, where she was the Chief People Officer, leading HR strategy, focused on employee growth and engagement, after roles at BigCommerce, Q2ebanking. At Sonatype, Manning seeks to deepen the organization's culture to ensure employees are supported and rewarded, enabling them to see the direct impact of their efforts. "I'm excited to be part of a company that puts its people and culture first, creating an environment where employees can thrive and innovate to help keep the world's software safe," said Sherri Manning, CHRO at Sonatype. "Sonatype already has great people doing important work. My mission is to ensure that employees can see the impact they are making in their day-to-day work." The need for secure AI development has never been clearer. With McClelland, Watson and Manning, Sonatype is strengthening its leadership to accelerate strategic growth, drive market leadership, and ensure the company remains the trusted authority in AI-driven DevSecOps, building on the critical foundation of Nexus Repository. To learn more about how Sonatype is advancing safe, compliant AI development with the Nexus One Platform, visit https://www.sonatype.com/products/nexus-one-platform. About Sonatype Sonatype is the company that accelerates agentic software development with confidence. Trusted by thousands of enterprises and millions of developers, Sonatype helps organizations build with confidence by governing the open source, AI-generated, and third-party components that power modern software. As the steward of Maven Central and the company behind Nexus Repository, Sonatype provides unmatched visibility into how software is built, consumed, and secured - helping teams move faster, reduce risk, and ship software with confidence at AI scale. To learn more about Sonatype, please visit www.sonatype.com. Megan Schmidt Sonatype [email protected] Legal Disclaimer: EIN Presswire provides this news content "as is" without warranty of any kind. Alabama Business Reporter do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.

Spring
Mar 18th, 2026
Spring Batch 6.0.3 and 5.2.5 available now.

Spring Batch 6.0.3 and 5.2.5 available now. On behalf of the team and all contributors, I am pleased to announce that Spring Batch 6.0.3 and 5.2.5 are available from Maven Central now. These releases come with a number of bug fixes, improvements and documentation updates. The release notes can be found on GitHub: 6.0.3, 5.2.5. These versions will be available respectively through Spring Boot 4.0.4 and 3.5.12. Get ahead. VMware offers training and certification to turbo-charge your progress. Get support. Tanzu Spring offers support and binaries for OpenJDK(TM), Spring, and Apache Tomcat(R) in one simple subscription.

SiliconANGLE Media
Dec 9th, 2025
Sonatype debuts guide to secure AI-assisted software development

Sonatype debuts guide to secure AI-assisted software development. Software supply chain management firm Sonatype Inc. today announced the launch of Sonatype Guide, a new developer tool that makes artificial intelligence-assisted software development faster, safer and more efficient. The service is designed to serve as an intelligent backbone that steers AI coding assistants toward secure, high-quality open-source components and autonomously maintains dependencies over time. The problem that Sonatype Guide is seeking to assist with is that AI models are trained on public data that may be months or years out of date. So AI coding assistants, intended to help developers move faster, frequently recommend vulnerable, low-quality or even imagined packages. According to a forthcoming study from Sonatype, leading generative AI large language models that power coding assistants hallucinate packages up to 27% of the time, meaning they attempt to update or develop modern software with nonexistent or malicious open-source components. That creates rework for development teams, slows delivery, burns LLM tokens and introduces unnecessary security risk. In pre-launch testing, enterprises using Sonatype Guide achieved more than a 300% improvement in security outcomes while reducing total security remediation. The service also improved dependency-upgrade costs by more than five compared to the leading competitive strategy, measured in both direct spend and developer hours. "Every organization wants to harness the productivity of AI, but they can't afford to compromise security or long-term maintainability," said Chief Executive Bhagwat Swaroop. "Guide brings discipline and intelligence to AI-assisted development. It empowers teams to move faster and safer by steering AI toward secure, reliable components and automating the tedious dependency work that slows teams down. This is a significant step forward for the industry and for our customers." Sonatype Guide works with popular AI coding assistants, including GitHub Copilot, Google Antigravity, Claude Code, Windsurf, IntelliJ with Junie, Kiro from Amazon Web Services Inc. and Cursor, to allow organizations to keep their existing workflows while upgrading the quality and security of the dependencies pulled in. Core features of Sonatype Guide include a Model Context Protocol Server for AI coding assistants, which intercepts package recommendations in real time to instantly guide developers to secure, reliable versions before code reaches the repo. The MCP server is complemented with enhanced open-source software search for instant decisions. It also has an enterprise-grade application programming interface that delivers complete, unrestricted and backward-compatible access to reliable data. Guide is built on Sonatype Intelligence, a source of real-time data on open-source quality, security and project health that can identify vulnerabilities, deprecations and malicious packages long before they spread. By embedding this intelligence directly into AI workflows, the company says, Guide ensures developers make safe, informed decisions from the start. Image: siliconangle/ideogram. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.

INACTIVE