Lead Technical Architect - SAST - Application Security

Role & responsibilities

We are seeking an experienced Lead SAST Architect specializing in Application Security and DevSecOps to lead and enhance our secure software development lifecycle (SDLC). The ideal candidate will have extensive experience in designing, implementing, and managing Static Application Security Testing (SAST) tools, integrating security into CI/CD pipelines, and driving secure coding practices across development teams.

1. SAST Strategy & Architecture:

• Design and implement SAST solutions aligned with enterprise security architecture.
• Develop scalable and efficient security frameworks for code analysis across multiple programming languages and environments.

2. Integration with DevSecOps:

• Embed SAST tools into CI/CD pipelines (e.g., Jenkins, GitLab, Azure DevOps).
• Automate security testing to support agile and DevOps workflows.

3. Application Security Leadership:

• Define and enforce secure coding standards and guidelines.
• Collaborate with development, QA, and DevOps teams to promote security best practices.

4. Risk Assessment & Vulnerability Management:

• Conduct security risk assessments, code reviews, and threat modeling.
• Analyze SAST findings, prioritize vulnerabilities, and guide remediation efforts.

5. Tool Management & Optimization:

• Manage SAST tools such as Checkmarx, Fortify, Veracode, SonarQube, etc.
• Continuously optimize configurations to reduce false positives and improve detection accuracy.

6. Training & Awareness:

• Develop training programs to educate developers on secure coding and vulnerability remediation.
• Lead security awareness sessions tailored to different technical audiences.

7. Governance & Compliance:

Ensure alignment with industry standards (e.g., OWASP, NIST, ISO 27001).

Support regulatory compliance initiatives by providing security evidence and reports

Preferred candidate profile

• Bachelors or masters degree in computer science, Information Security, or related field.
• 10 - 15 years of experience in Application Security, DevSecOps, and SAST.
• Strong hands-on expertise with SAST tools: Checkmarx, Fortify, Veracode,
• SonarQube, etc.
• Proficiency in integrating security tools into CI/CD pipelines (e.g., Jenkins, GitLab,
• Azure DevOps).
• Solid understanding of secure coding practices in languages like Java, .NET, Python,
• JavaScript, C/C++.
• Experience with Threat Modeling, Code Reviews, and Risk Assessment
• methodologies.
• Strong knowledge of DevOps practices, container security (e.g., Docker, Kubernetes),
• and cloud security (AWS, Azure, GCP).
• Familiarity with security standards: OWASP Top 10, SANS CWE, NIST, ISO 27001.
• Excellent problem-solving, communication, and leadership skills.
• Preferred Certifications:
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• Certified Secure Software Lifecycle Professional (CSSLP)
• GIAC Web Application Penetration Tester (GWAPT)
• AWS/Azure Security Certifications