AppSec Engineer - SAST & SCA in DevSecOps

US staffing Inc; San Jose (CA); On-site; USD 150,000 - 210,000; Full time

Job summary

Adroit Innovative is seeking an experienced Security Engineer specializing in Application Security (AppSec) with strong SAST and SCA expertise in San Jose, CA. This on-site role partners with development teams to embed security across the SDLC and to secure applications and open-source components.

Responsibilities include performing SAST and SCA, remediation of vulnerabilities, integrating security into CI/CD, automating scans and reports, and supporting ISO and SOC2 compliance.

Qualifications

• 10+ years of experience in Application Security, DevSecOps, or Secure Software Development.
• Hands-on with SAST tools: Checkmarx, Fortify, Veracode, CodeQL.
• Experience with SCA tools: Snyk, Black Duck, Mend (WhiteSource), Sonatype, Dependabot.
• Strong understanding of OWASP Top 10.
• Secure Coding Practices, Vulnerability Management, CVSS Scoring.
• Experience integrating security into GitHub, GitLab, Azure DevOps, Jenkins, CI/CD Pipelines.
• Scripting knowledge in Python, Bash, or PowerShell.
• Experience with Jira or similar ticketing tools.

Responsibilities

• Perform Static Application Security Testing (SAST) and Software Composition Analysis (SCA).
• Identify, prioritize, and remediate vulnerabilities in applications and open-source software.
• Integrate security into CI/CD pipelines and developer workflows.
• Automate security scans, reporting, and vulnerability tracking.
• Partner with engineering teams to promote secure coding practices.
• Support compliance initiatives including ISO and SOC2

Skills

AppSec

DevSecOps

CI/CD pipelines

OWASP Top 10

Scripting

Jira

Tools

Checkmarx

Fortify

Veracode

CodeQL

Snyk

Black Duck

Mend (WhiteSource)

Sonatype

Dependabot

Job description

Adroit Innovative is seeking an experienced Security Engineer specializing in Application Security (AppSec) with strong SAST and SCA expertise in San Jose, CA. This on-site role partners with development teams to embed security across the SDLC and to secure applications and open-source components.

Responsibilities include performing SAST and SCA, remediation of vulnerabilities, integrating security into CI/CD, automating scans and reports, and supporting ISO and SOC2 compliance.