Security Engineer – SAST & SCA (Application Security)

US staffing Inc; San Jose (CA); On-site; USD 170,000 - 210,000; Full time

Job summary

Adroit Innovative is seeking a Security Engineer specializing in SAST & SCA to safeguard our applications in a San Jose, CA environment. The role focuses on embedding security into CI/CD workflows and promoting secure coding across engineering teams.

The ideal candidate brings extensive hands-on experience with diverse SAST/SCA tools and strong knowledge of OWASP Top 10, along with scripting skills and Jira proficiency. Onsite work in California required.

Qualifications

• 10+ years of experience in Application Security, DevSecOps, or Secure Software Development.
• Hands-on experience with SAST tools: Checkmarx, Fortify, Veracode, CodeQL.
• Experience with SCA tools: Snyk, Black Duck, Mend (WhiteSource), Sonatype, Dependabot.
• Strong understanding of: OWASP Top 10.
• Secure Coding Practices, Vulnerability Management, CVSS Scoring.
• Experience integrating security into: GitHub, GitLab, Azure DevOps, Jenkins, CI/CD Pipelines.
• Scripting knowledge in Python, Bash, or PowerShell.
• Experience with Jira or similar ticketing tools.

Responsibilities

• Perform Static Application Security Testing (SAST) and Software Composition Analysis (SCA).
• Identify, prioritize, and remediate vulnerabilities in applications and open-source software.
• Integrate security into CI/CD pipelines and developer workflows.
• Automate security scans, reporting, and vulnerability tracking.
• Partner with engineering teams to promote secure coding practices.
• Support compliance initiatives including ISO and SOC2.

Skills

10+ years experience

SAST tools

SCA tools

OWASP Top 10

Secure Coding Practices

Vulnerability Management

CVSS Scoring

CI/CD Integration

Scripting (Python/Bash/PowerShell)

Ticketing (Jira)

Education

CSSLP

GWAPT

OSCP

Tools

Checkmarx

Fortify

Veracode

CodeQL

Snyk

Black Duck

Mend (WhiteSource)

Sonatype

Dependabot

GitHub

GitLab

Azure DevOps

Jenkins

Job description

Job Title: Security Engineer – SAST & SCA (Application Security)
Location: San Jose, CA (5 Days Onsite)

Required Skills

• 10+ years of experience in Application Security, DevSecOps, or Secure Software Development.
• Hands-on experience with SAST tools: Checkmarx, Fortify, Veracode, CodeQL
• Experience with SCA tools: Snyk, Black Duck, Mend (WhiteSource), Sonatype, Dependabot
• Strong understanding of: OWASP Top 10
• Secure Coding Practices, Vulnerability Management, CVSS Scoring
• Experience integrating security into: GitHub, GitLab, Azure DevOps, Jenkins, CI/CD Pipelines
• Scripting knowledge in Python, Bash, or PowerShell.
• Experience with Jira or similar ticketing tools.

Preferred Skills

• SBOM (CycloneDX, SPDX)
• Container Security
• Dependency Scanning
• Cloud Application Security
• Infrastructure as Code (Terraform Security)

CSSLP, GWAPT, or OSCP certifications are required.

Responsibilities

• Perform Static Application Security Testing (SAST) and Software Composition Analysis (SCA).
• Identify, prioritize, and remediate vulnerabilities in applications and open-source software.
• Integrate security into CI/CD pipelines and developer workflows.
• Automate security scans, reporting, and vulnerability tracking.
• Partner with engineering teams to promote secure coding practices.
• Support compliance initiatives including ISO and SOC2.

Contact: Sana Parikshith
[e-mail]
469-827-7611