DevSecOps L3 Engineering Expert – Application Security (Threat Modeling)

Job summary

Implement and orchestrate security scanning across CI/CD pipelines, integrating SAST, DAST, and SCA tools with applications written in multiple languages. Build Python-based integrations, troubleshoot scanning issues, and support threat modeling and automation to improve security while reducing false positives and developer friction.

Job details

DevSecOps L3 Engineering Expert – Application Security (Threat Modeling) Ontario, Canada (Remote) Full-Time Job Summary: As a DevSecOps L3 Engineering Expert, the candidate will be part of an Application Security & DevSecOps Engineering Pod that implements and orchestrates code-scanning across the client's software delivery pipelines. The role builds Python-based integrations and orchestration, troubleshoots scanning across languages and supports threat modeling to embed security early in the SDLC. Role and Responsibilities: Complete assigned DevSecOps engineering tasks and stories within agreed throughput. Implement code-scanning tool orchestration across CI/CD pipelines. Implement and operate DAST, SAST and SCA tools including Snyk, Invicti and SonarQube. Integrate scanning for Java, Python, TypeScript and other codebases. Troubleshoot code-scanning issues across programming languages and build systems. Create Python APIs and orchestration for security-tool and pipeline integration. Support threat modeling of applications and translate findings into security requirements. Participate in related network-core activities. Drive automation and AI-assisted improvements to reduce false positives and developer friction. Key Skills: At least 7+ years of experience in IT with 4+ years in DevSecOps or application security engineering. Hands-on experience with Snyk, Invicti (Netsparker), SonarQube and other SAST/DAST/SCA tools. Strong Python development skills, including building REST APIs and integrations. Working knowledge of Java, TypeScript/JavaScript build ecosystems (Maven, Gradle, npm). Experience with CI/CD platforms (GitHub Actions, Harness, Jenkins, Bamboo) and Git. Experience with threat modeling methodologies (STRIDE, PASTA) and tools. Understanding of OWASP Top 10, OWASP ASVS and secure coding practices. Exposure to containers and Kubernetes security scanning is a plus. Experience working in Agile teams with JIRA. Excellent problem solving and developer-facing communication skills. High level of initiative and ownership mentality. Education & Certifications: B.Tech / B.E / M.Tech / MCA OR Any PG (Computer Science, IT, Information Security or related discipline). Technical Certifications are desired and a plus, such as: Certified DevSecOps Professional (CDP), GIAC GWEB / GCSA, CSSLP, Snyk / SonarQube certifications, AWS or Azure DevOps certifications. About Solugenix Solugenix is a leader in IT services, delivering cutting-edge technology solutions, exceptional talent, and managed services to global enterprises. With extensive expertise in highly regulated and complex industries, we are a trusted partner for integrating advanced technologies with streamlined processes. Our solutions drive growth, foster innovation, and ensure compliance—providing clients with reliability and a strong competitive edge. Recognized as a 2024 Top Workplace, Solugenix is proud of its inclusive culture and unwavering commitment to excellence. Our recent expansion, with new offices in the Dominican Republic, Jakarta, and the Philippines, underscores our growing global presence and ability to offer world-class technology solutions. Partnering with Solugenix means more than just business—it means having a dedicated ally focused on your success in today's fast-evolving digital world.

What you’ll do

Implement and orchestrate security scanning across CI/CD pipelines, integrating SAST, DAST, and SCA tools with applications written in multiple languages. Build Python-based integrations, troubleshoot scanning issues, and support threat modeling and automation to improve security while reducing false positives and developer friction.

Requirements

Requires at least 7 years of IT experience, including 4 or more years in DevSecOps or application security, with hands-on experience using security scanning tools and strong Python integration skills. Candidates should know CI/CD platforms, Java and JavaScript/TypeScript build ecosystems, threat modeling, OWASP guidance, and Agile practices; a relevant degree is specified, and technical certifications are desired.

Listed skills

• Kubernetes · Preferred
• REST APIs · Preferred
• CI/CD · Preferred
• TypeScript · Preferred
• Java · Preferred
• Python · Preferred

Other relevant skills

Identified from the job description. Confirm important requirements above.

• DevSecOps
• Application Security
• Threat Modeling
• Python
• REST APIs
• Snyk
• Invicti
• SonarQube
• SAST
• DAST
• SCA
• CI/CD
• Java
• TypeScript
• Kubernetes
• OWASP

Job areas

• Technology
• Software
• Security & Safety
• Engineering

More jobs from Solugenix