Application Security Tester / DevSecOps Lead
Core
Lead application security testing and DevSecOps operations across cloud-native .NET, legacy .NET/IIS, and COBOL mainframe environments, integrating security gates into CI/CD pipelines.
Role type
Senior IC DevSecOps Lead (Application Security)
Builds
Secure CI/CD pipelines with enforced SAST/DAST/SCA gates for .NET, legacy, and mainframe stacks
Domain
Application Security / DevSecOps / Mainframe Modernization
Deliverable
production ML models
Required skills
Fortify SAST configuration, Sonatype SCA, WebInspect DAST, GitHub Actions, Ansible, Harness, Nexus, Dynatrace, Splunk, AI agent orchestration, LLM fine-tuning, SLA program management, compliance reporting (ISO 27001, SOC 2, NIST CSF, ISO 42001)
Preferred skills
AI governance and safety practices, human-in-the-loop security decisioning, model-drift monitoring
Technologies
.NET Framework, .NET Core, AKS, IIS, COBOL, Azure, Kubernetes, GitHub, GitLab, SonarQube, Dynatrace, Splunk, Nexus, Fortify, Sonatype, WebInspect, Ansible, Harness, GitHub Actions
Responsibilities
Configure Fortify SAST as a blocking control across .NET and COBOL pipelines; tune rulesets and suppression policies to reduce false positives; manage exceptions and waivers with compensating controls; expand Sonatype SCA coverage to legacy IIS/VB.NET applications; pilot static analysis on COBOL mainframe codebase; maintain WebInspect DAST scans for staging/pre-prod; integrate security tools into CI/CD using GitHub Actions/Ansible/Harness; automate vulnerability remediation workflows with SLA tracking; report enforcement status and risk trends to leadership; use AI agents to consolidate findings and apply AI-assisted triage; establish guardrails and audit trails for AI-driven security decisions
Seniority
Senior, hands-on IC