Sr SCA Engineer

Zelis is one of the leading healthcare technology Product organizations with $1.4 Billion revenue with year-on-year growth of 22% and client retention rate of 120%. we offer wide range of innovative solutions to the healthcare payers, providers, and consumers. Our services include network analytics, payment integrity and optimization, provider credentialing, and provider engagement.

Zelis is an US based Software Product development organization founded in 1995 with a headcount 2400+ talented professionals working in 7 offices in US and 1 global capacity center located in Hyderabad, India.

URL: https://www.zelis.com

We are looking for an experienced Application Security Engineer with a strong focus on Software Composition Analysis (SCA) to join our growing security team. The ideal candidate will have hands-on expertise managing open-source and third-party dependency risk across artifact repositories and package management ecosystems, along with working knowledge of Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST). This role will be responsible for identifying, assessing, and remediating vulnerabilities and license risks across our application portfolio, and driving a culture of secure dependency management across engineering teams.

8 to 10 years of relevant experience in Application Security, DevSecOps, or a related field.

Own and drive the Software Composition Analysis (SCA) program end-to-end — identifying, tracking, and remediating vulnerabilities and license compliance risks in open-source and third-party components/dependencies.

Configure, manage, and optimize artifact repositories and package registries (JFrog Artifactory/Xray, Sonatype Nexus Repository, Azure Artifacts, GitHub Packages, GitLab Package Registry, AWS CodeArtifact, Google Artifact Registry) with embedded SCA scanning and policy enforcement.

Establish dependency governance policies (approved/blocked components, license risk thresholds, version pinning strategies) across engineering teams.

Monitor for newly disclosed CVEs affecting existing dependencies and drive timely remediation or patching across affected applications.

Maintain a Software Bill of Materials (SBOM) process and ensure traceability of open-source usage across the application portfolio.

Configure, maintain, and optimize SAST and DAST tools across the CI/CD pipeline to enable early detection of security vulnerabilities.

Integrate security scanning tools (SCA, SAST, DAST) into build and deployment pipelines (Jenkins, GitLab CI, Azure DevOps, GitHub Actions, etc.).

Triage, prioritize, and track remediation of vulnerabilities identified through SCA, SAST, and DAST scans in collaboration with development teams.

Conduct manual code reviews and validate automated scan findings to reduce false positives.

Partner with development, DevOps, and QA teams to embed security practices into the SDLC (Shift-Left Security).

Develop and maintain application security policies, standards, and guidelines.

Support periodic penetration testing efforts and coordinate remediation of findings with relevant stakeholders.

Track and report key application security metrics (vulnerability trends, MTTR, tool coverage, etc.) to leadership.

Stay current with emerging threats, vulnerabilities (OWASP Top 10, CWE/SANS Top 25), and industry best practices.

Provide guidance and training to development teams on secure coding practices and remediation techniques.

Veracode

Checkmarx

HCL AppScan

SonarQube

Invicti (Netsparker)

Acunetix

OWASP ZAP

Veracode DAST / Burp Suite (a plus)

At Zelis, we champion diversity, equity, inclusion, and belonging in all aspects of our operations. We embrace the power of diversity and create an environment where people can bring their authentic and best selves to work. We know that a sense of belonging is key not only to your success at Zelis, but also to your ability to bring your best each day.

Zelis is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

We are dedicated to ensuring our application process is accessible to all candidates. If you are a qualified individual with a disability and require reasonable accommodation with any part of the application and/or interview process, please email talentacquisition@zelis.com .