Application Security Engineer – Software Composition Analysis (SCA)

LE018 Zelis Healthcare, LLC; Plano (TX); On-site; USD 127,000 - 160,550; Full time

Benefits offered by this job

401(k) plan with employer match

PTO & holidays

Life insurance

Health benefits

Job summary

Zelis Healthcare, LLC in Plano, TX seeks an experienced Application Security Engineer with deep SCA expertise to strengthen the security of our software supply chain and embed security controls throughout the SDLC. You will help integrate scanning tools into CI/CD pipelines and partner with developers to triage vulnerabilities.

The ideal candidate will have extensive experience in integrating SCA tooling, evaluating exploitability, and enabling secure application development at scale.

Qualifications

• Bachelor's degree in a related technical field.
• Experience with SCA and application security tooling in CI/CD.
• Experience managing open-source license compliance and governance.
• Strong secure coding practices and threat modeling experience.

Responsibilities

• Lead the implementation and optimization of SCA solutions across enterprise apps.
• Establish processes for open-source risk and license compliance management.
• Integrate SCA and security tooling into CI/CD pipelines for continuous validation.
• Deploy and manage security platforms (Snyk, Black Duck, Mend, Veracode, Checkmarx ONE).
• Embed guardrails in build pipelines using Jenkins, GitHub Actions, or GitLab CI.
• Analyze vulnerabilities for exploitability, reachability, and impact.
• Prioritize findings and guide remediation to reduce risk.
• Develop OSS governance policies and provide secure coding guidance.

Skills

Java

Python

C++

Ruby

Education

Bachelor's degree in CS/IT/Cybersecurity

Tools

Snyk

Black Duck

Mend

Veracode

Checkmarx ONE

Artifactory

Jenkins

GitHub Actions

GitLab CI

Job description

Position Overview

Zelis is seeking an experienced Application Security Engineer with deep expertise in Software Composition Analysis (SCA) to strengthen the security of our software supply chain and reduce risks associated with open‑source and third‑party software components in internally developed applications. This role will help integrate scanning tools into CI/CD pipelines and partner with developers, engineering teams to triage vulnerabilities to embed security controls throughout the software development lifecycle. The ideal candidate will have extensive experience integrating SCA and application security tooling into CI/CD pipelines, evaluating vulnerability exploitability, managing open‑source license compliance, and enabling developers to build secure applications at scale. Experience with AI/LLM‑focused security scanning tools and emerging application security technologies is highly desirable.

Key Responsibilities

• Lead the implementation and optimization of Software Composition Analysis (SCA) solutions to identify vulnerabilities, license compliance issues, and software supply chain risks across enterprise applications.
• Establish and maintain processes for managing risks associated with open‑source and third‑party software dependencies.
• Integrate and automate SCA and application security tools within CI/CD pipelines to provide continuous security validation throughout the software development lifecycle.
• Deploy and manage security platforms such as Synk, Black Duck, Mend, Veracode, Checkmarx ONE; experience with emerging AI/LLM‑based security scanning solutions is desirable.
• Embed security guardrails into build pipelines using tools like Jenkins, GitHub Actions, or GitLab CI.
• Integrate Artifactory into pipeline and developer workflows where applicable.
• Analyze identified vulnerabilities to determine exploitability, reachability, and potential business impact.
• Perform risk‑based prioritization of findings, focusing remediation efforts on vulnerabilities that pose the greatest threat to the organization.
• Validate findings to reduce false positives and improve overall vulnerability management effectiveness.
• Develop, maintain, and enforce open‑source software governance policies.
• Provide technical guidance, secure coding practices, and best practices to development teams.
• Strong proficiency in programming languages including Java, Python, C++, Ruby.
• Strong understanding of how third‑party packages are integrated through external public repositories (e.g., npm for JavaScript, pip for Python, Maven/Gradle for Java).
• Knowledge of application security best practices and industry standards, including OWASP Top 10, Secure Software Development Lifecycle (SSDLC), Software Supply Chain Security principles, and Vulnerability Management frameworks.

Professional Skills

• Excellent communication, strong analytical thinking, and problem‑solving capabilities.
• Self‑motivated with a commitment to continuous learning and staying current with evolving security threats and technologies.

Education

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical discipline.

Location and Workplace Flexibility

Zelis is headquartered in the U.S., with multiple locations across the country and in Hyderabad, India. Work locations are based on the needs of the position and are determined by the Leadership team. In‑office work and activities vary based on work and team objectives in accordance with company policies. While location expectations vary by role, candidates within approximately 50 miles of a U.S. office are generally preferred to support collaboration when needed. Our hybrid approach is flexible, and in‑office presence is guided by team and business needs rather than a fixed weekly schedule.

Base Salary Range

$127,000.00 - $160,550.00

Benefits

• 401(k) plan with employer match.
• Flexible paid time off, holidays, parental leaves.
• Life and disability insurance.
• Health benefits including medical, dental, vision, and prescription drug coverage.

Equal Employment Opportunity

Zelis is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. We welcome applicants from all backgrounds and encourage you to apply even if you don’t meet 100% of the qualifications for the role.

Accessibility Support

If you are a qualified individual with a disability or a disabled veteran and require a reasonable accommodation with any part of the application and/or interview process, please email [e-mail].

Disclaimer

The above statements are intended to describe the general nature and level of work being performed by people assigned to this classification. They are not to be construed as an exhaustive list of all responsibilities, duties, and skills required of personnel so classified. All personnel may be required to perform duties outside of their normal responsibilities, duties, and skills from time to time.