AppSec Tooling Engineer — CI/CD & SCA/SAST

Conviso Inc.; United States; On-site; USD 140,000 - 200,000; Full time

Job summary

Conviso Inc. is seeking an Application Security Tooling Engineer to design, operate, and continuously improve an enterprise-grade AppSec scanning ecosystem across the SDLC.

The role spans SCA with Sonatype, SAST with Fortify, StackRox container security, and DAST with Burp Suite, ensuring scalable, auditable security controls in regulated environments. You will deploy, configure, and harden these tools in on-prem and accredited cloud environments, manage upgrades and SLAs, and integrate with

Qualifications

• 5+ years in application security engineering or DevSecOps in regulated environments.

Responsibilities

• Design, operate and improve the AppSec scanning ecosystem across the SDLC.
• Deploy, configure, harden and maintain Sonatype, Fortify, StackRox, and Burp in on-prem or cloud environments.
• Integrate tools into CI/CD pipelines with policy-based gating and risk-based exceptions.
• Define and tune scanning policies aligned to agency standards.
• Provide actionable findings with clear reproduction steps and secure coding guidance.
• Coordinate remediation with engineering teams for code, dependencies, containers, and Kubernetes configurations.
• Maintain auditable vulnerability management workflows and incident-ready detections.

Skills

DevSecOps

CI/CD automation

Security policy tuning

Vulnerability management

Incident response

Tools

Sonatype Nexus IQ/Lifecycle

Fortify SCA/SSC

StackRox / Red Hat ACS

Burp Suite

Jenkins

GitLab CI

Job description

Conviso Inc. is seeking an Application Security Tooling Engineer to design, operate, and continuously improve an enterprise-grade AppSec scanning ecosystem across the SDLC.

The role spans SCA with Sonatype, SAST with Fortify, StackRox container security, and DAST with Burp Suite, ensuring scalable, auditable security controls in regulated environments. You will deploy, configure, and harden these tools in on-prem and accredited cloud environments, manage upgrades and SLAs, and integrate with