DevSecOps SCA Tech Lead
About The Position
Core Responsibilities Serve as the technical lead and subject matter expert for Software Composition Analysis (SCA), partnering closely with the AppSec team lead and manager to execute strategy and roadmap for open-source and dependency security across the SDLC. Lead the design, configuration, and continuous optimization of SCA tooling, including policy definition, risk and reachability tuning, and CI/CD integration at scale. Drive risk-based vulnerability management for open-source dependencies, providing guidance on prioritization, remediation approaches, and risk acceptance decisions. Define and maintain standards, guardrails, and best practices for open-source usage, including approved dependency policies, vulnerability thresholds, and exception workflows. Act as the primary point of contact for SCA, collaborating with application teams, platform teams, App Sec peers, and other security stakeholders to ensure alignment and effective execution. Participate in an on-call rotation to support application security tooling, assist developers, and respond to security threat events when required. Champion a developer-first experience by improving signal quality, reducing noise, and delivering clear, actionable remediation guidance aligned with engineering workflows. Identify, design, and implement automation and process improvements to enhance dependency visibility, response times, and program scalability. Define, track, and communicate key metrics and insights related to open-source risk, remediation effectiveness, and SCA program maturity to stakeholders and leadership. Provide technical leadership and mentorship to App Sec engineers and development teams on secure dependency management and emerging open-source risks. Maintain comprehensive documentation for SCA technologies, processes, and standards; stay current on industry trends, tooling, and open-source security threats. Participate in strategic initiatives and cross-functional efforts to advance the broader Application Security program.
Requirements
- Bachelor’s degree in a related field or equivalent experience
- Hands-on experience deploying and operating SCA/SAST tools, including onboarding, auth setup, and CI/CD integration
- Experience with additional AppSec tools (Secret Scanning, IAST, DAST, etc.)
- Strong understanding of modern application development and delivery (IDEs, repos, CI/CD, cloud, containers, serverless)
- Working knowledge of NIST, OWASP, and MITRE frameworks
Nice To Haves
- AppSec, DevSecOps, cloud, or development certifications a plus
Responsibilities
- Serve as the technical lead and subject matter expert for Software Composition Analysis (SCA), partnering closely with the AppSec team lead and manager to execute strategy and roadmap for open-source and dependency security across the SDLC.
- Lead the design, configuration, and continuous optimization of SCA tooling, including policy definition, risk and reachability tuning, and CI/CD integration at scale.
- Drive risk-based vulnerability management for open-source dependencies, providing guidance on prioritization, remediation approaches, and risk acceptance decisions.
- Define and maintain standards, guardrails, and best practices for open-source usage, including approved dependency policies, vulnerability thresholds, and exception workflows.
- Act as the primary point of contact for SCA, collaborating with application teams, platform teams, App Sec peers, and other security stakeholders to ensure alignment and effective execution.
- Participate in an on-call rotation to support application security tooling, assist developers, and respond to security threat events when required.
- Champion a developer-first experience by improving signal quality, reducing noise, and delivering clear, actionable remediation guidance aligned with engineering workflows.
- Identify, design, and implement automation and process improvements to enhance dependency visibility, response times, and program scalability.
- Define, track, and communicate key metrics and insights related to open-source risk, remediation effectiveness, and SCA program maturity to stakeholders and leadership.
- Provide technical leadership and mentorship to App Sec engineers and development teams on secure dependency management and emerging open-source risks.
- Maintain comprehensive documentation for SCA technologies, processes, and standards; stay current on industry trends, tooling, and open-source security threats.
- Participate in strategic initiatives and cross-functional efforts to advance the broader Application Security program.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Number of Employees
5,001-10,000 employees
