You will lead CP Axtra's Application Security program end-to-end — from defining secure SDLC policies to managing the toolchain that enforces them. You'll own the SAST, SCA, DAST, and secrets scanning platforms (Checkmarx, SonarQube, Qualys WAS, Spectral, OWASP ZAP) and ensure they're integrated into every CI/CD pipeline, producing actionable results rather than alert fatigue.

This is a leadership role with deep technical expectations. You'll manage the SAST/SCA/DAST/IaC Security Manager, consult directly with development teams on secure design and remediation, and represent application security in architecture reviews. You'll need to balance enforcement with enablement — developers should see your team as a resource that helps them ship securely, not a gate that slows them down.

The right person combines strong application security expertise with the communication skills to influence development culture across a large, diverse engineering organization.

KEY RESPONSIBILITIES

· Own and evolve CP Axtra's Secure SDLC framework — defining security requirements, review gates, and testing standards for all software development projects

· Manage and optimize the AppSec toolchain (Checkmarx, SonarQube, Qualys WAS, Spectral, OWASP ZAP), ensuring high detection rates with low false positive noise

· Drive CI/CD pipeline security integration across GitHub Actions, Azure DevOps, and Jenkins — making security checks automated, fast, and non-bypassable

· Lead threat modeling and secure design reviews for high-risk applications, including e-commerce platforms, payment integrations, and customer data systems

· Consult with development teams on vulnerability remediation — not just telling them what's broken, but helping them understand the fix and the 'why' behind it

· Define and enforce security quality gates: what blocks a release, what generates a warning, and what gets tracked for future remediation

· Manage the SAST/SCA/DAST/IaC Security Manager, providing technical direction and ensuring operational excellence across the scanning platforms

· Report application security posture metrics to the Associate Director and CISO — trends in vulnerability density, remediation velocity, and coverage gaps

· Evaluate emerging AppSec technologies including AI-assisted code review and automated fix suggestion tools

· Coordinate with the Offensive Security team to align penetration testing priorities with application risk profiles

RequirementsTECHNICAL REQUIREMENTS

· Checkmarx (SAST/SCA), SonarQube, Qualys WAS, Spectral, OWASP ZAP

· CI/CD platforms: GitHub Actions, Azure DevOps, Jenkins