2 days ago
Hyderābād, IndiaSenior
Responsibilities
- Own the end-to-end Software Composition Analysis program for vulnerability and open-source license risk management.
- Configure and optimize artifact repositories and package registries with embedded scanning and policy enforcement.
- Establish dependency governance, monitor CVEs, drive remediation, and maintain SBOM traceability.
- Configure SAST and DAST tools and integrate SCA, SAST, and DAST scanning into CI/CD pipelines.
- Triage findings, conduct manual code reviews, validate scan results, and coordinate remediation with engineering teams.
- Partner with development, DevOps, QA, and compliance teams to embed secure practices into the SDLC.
- Develop application security policies, standards, and guidelines and provide secure coding training.
- Support penetration testing, track application security metrics, and report trends and remediation performance to leadership.
Requirements
- 8 to 10 years of relevant experience in Application Security, DevSecOps, or a related field.
- Hands-on experience with at least two to three artifact repository or package registry tools, including SCA configuration and policy enforcement.
- Experience with SBOM generation using CycloneDX or SPDX and open-source license compliance scanning.
- Working knowledge of SAST and DAST tools, CI/CD integration, vulnerability triage, and remediation.
- Knowledge of OWASP Top 10, CWE/SANS Top 25, common vulnerability classes, API security, and secure API design.
- Working knowledge of at least one programming or scripting language such as Java, Python, JavaScript, or .NET.
- Understanding of container security and cloud security concepts across AWS, Azure, or GCP is preferred.
- Bachelor's degree in computer science, information security, or a related field, or equivalent practical experience.
- Security certifications such as CEH, OSCP, GWAPT, CSSLP, or Security+ are preferred but not mandatory.
- Experience in Agile or DevOps environments and the ability to communicate security issues to technical and non-technical stakeholders.
Benefits
- Opportunity to build and shape a growing application security program.
- Exposure to modern DevSecOps tools and practices.
- Collaborative work culture with continuous learning opportunities.
- Hybrid work flexibility, comprehensive healthcare benefits, financial wellness programs, and cultural celebrations.
- Competitive compensation and benefits package.
Tech Stack
Categories
About Zelis
Zelis builds a connected healthcare payments and pricing platform for U.S. payers, providers, and consumers, offering payment integrity, claims pricing/bill review, electronic payments, and network optimization. It sells software and managed services to health plans, TPAs, and self-insured employers to reduce claims errors and streamline reimbursement. Privately held and headquartered in Boston, it serves over 750 payers, including the top five national health plans, and millions of healthcare professionals and consumers.