Application Security Engineer – Software Composition Analysis (SCA)

About the role

Zelis is modernizing the healthcare financial experience across payers, providers, and healthcare consumers. We serve more than 750 payers, including the top five national health plans, regional health plans, TPAs and millions of healthcare providers and consumers across our platform of solutions. This role involves strengthening the security of our software supply chain and reducing risks associated with open-source and third-party software components in internally developed applications.

Responsibilities

• Lead the implementation and optimization of Software Composition Analysis (SCA) solutions to identify vulnerabilities, license compliance issues, and software supply chain risks across enterprise applications.
• Evaluate vulnerability exploitability, manage open-source license compliance, and enable developers to build secure applications at scale.
• Analyze identified vulnerabilities to determine exploitability, reachability, and potential business impact.
• Perform risk-based prioritization of findings, focusing remediation efforts on vulnerabilities that pose the greatest threat to the organization.
• Develop, maintain, and enforce open-source software governance policies.
• Provide technical guidance, security coding and best practices to development teams.
• Embed security guardrails into build pipelines using tools like Jenkins, GitHub Actions, or GitLab CI.
• Deploy and manage security platforms such as Synk, Black Duck, Mend, Veracode, Checkmarx ONE, and emerging AI/LLM-based security scanning solutions.
• Artifactory integration experience in the pipeline and developer workflows.

Requirements

Experience with AI/LLM-focused security scanning tools and emerging application security technologies is highly desirable.

Qualifications

• 8+ years of experience in various AppSec domains.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related technical discipline.

Skills

• Strong proficiency in multiple programming languages, including Java, Python, C++, Ruby.
• Excellent communication, strong analytical thinking and problem-solving capabilities.
• Self-motivated with a commitment to continuous learning and staying current with evolving security threats and technologies.

Benefits

The US-based benefits include a 401k plan with employer match, flexible paid time off, holidays, parental leaves, life and disability insurance, and health benefits including medical, dental, vision, and prescription drug coverage.

Pay

$127,000.00 - $160,550.00

Schedule

Hybrid work model with in-office presence guided by team and business needs rather than a fixed weekly schedule.