You will manage the day-to-day operations and continuous improvement of CP Axtra's security testing platforms: Checkmarx for SAST and SCA, SonarQube for code quality and security, Qualys WAS and OWASP ZAP for DAST, Spectral for secrets detection, and IaC scanning tools for Terraform and container configurations. Your mission is to make these tools genuinely useful — high signal, low noise, seamlessly integrated into every CI/CD pipeline.
You'll work closely with the Application Security Lead on strategy while owning execution. This means tuning scan policies, onboarding new repositories, troubleshooting pipeline integrations, training developers on interpreting results, and continuously reducing false positive rates. You'll also extend coverage into container security and infrastructure-as-code scanning as CP Axtra's cloud-native footprint grows.
Success in this role means developers trust the tools — they fix what the scanner flags because they know the findings are real and the remediation guidance is actionable.
You will manage the day-to-day operations and continuous improvement of CP Axtra's security testing platforms: Checkmarx for SAST and SCA, SonarQube for code quality and security, Qualys WAS and OWASP ZAP for DAST, Spectral for secrets detection, and IaC scanning tools for Terraform and container configurations. Your mission is to make these tools genuinely useful — high signal, low noise, seamlessly integrated into every CI/CD pipeline.
You'll work closely with the Application Security Lead on strategy while owning execution. This means tuning scan policies, onboarding new repositories, troubleshooting pipeline integrations, training developers on interpreting results, and continuously reducing false positive rates. You'll also extend coverage into container security and infrastructure-as-code scanning as CP Axtra's cloud-native footprint grows.
Success in this role means developers trust the tools — they fix what the scanner flags because they know the findings are real and the remediation guidance is actionable.
Requirements
TECHNICAL REQUIREMENTS
· Checkmarx (SAST/SCA), SonarQube, Qualys WAS, OWASP ZAP, Spectral
· CI/CD platforms: GitHub Actions, Azure DevOps, Jenkins
· Container scanning: Trivy, Grype, or equivalent
· IaC scanning: Checkov, tfsec, or equivalent
· Scripting for automation: Python, Bash, or YAML-based pipeline configuration
MUST-HAVE REQUIREMENTS
These are non-negotiable. If you do not meet all of these, this role is not the right fit.
· 5+ years of experience managing DevSecOps or application security testing platforms in a production environment
· Hands-on expertise with at least 2 of: Checkmarx, SonarQube, Snyk, Veracode, Fortify, or equivalent SAST/SCA platforms
· Experience integrating security scanning into CI/CD pipelines — GitHub Actions, Azure DevOps, Jenkins, or GitLab CI
· Strong understanding of DAST tools and web application scanning (Qualys WAS, OWASP ZAP, Burp Suite Enterprise, or equivalent)
· Ability to tune scan policies, write custom rules, and reduce false positive rates — this is a core competency, not a nice-to-have
· Working knowledge of container security scanning (Trivy, Grype, or equivalent) and IaC scanning (Checkov, tfsec, or equivalent)
· Clear communication skills for working with developers who may not have security backgrounds
NICE-TO-HAVE
These will set you apart from other candidates:
· Experience with Spectral or other secrets detection platforms
· Background in software development — understanding build systems, dependency management, and package registries
· Familiarity with SonarQube quality profiles and custom rule development
· Experience managing scanning platforms at scale (100+ repositories, multiple development teams)
· Knowledge of supply chain security: SBOM generation, dependency confusion prevention, provenance verification
· CDE (Certified DevSecOps Engineer), CSSLP, or equivalent certification