**Job summary** Embeds the clients security and compliance requirements into Flowsource pipelines and the control plane configuring SAST Checkmarx SCA Prisma Cloud container image scanning IaC scanning and Veracode to enforce policy as code aligned to the clients compliance framework SOC 2 PCI DSS HIPAA ISO 27001 Owns the security quality gates vulnerability disclosure workflows and the leadership facing compliance dashboards inside Flowsource Configures tooling against client owned policy does not set po **Responsibilities** Configure SAST Checkmarx SCA Prisma Cloud image scanning IaC scanning and Veracode integrations inside Flowsource pipeline templates Codify the clients security policy as enforceable gates severity thresholds allow deny lists exception workflows Operate the vulnerability triage and disclosure workflow surfaced inside Flowsource route findings to the right squad with SLA Build and maintain leadership facing compliance dashboards open critical mean time to remediate control coverage Partner with DevOps and Pipeline Integrator to keep pipeline gates consistent across every onboarded application Support client audit readiness by exporting Flowsource evidence packs scan history gate enforcement remediation timelines Stay aligned with the client compliance framework SOC 2 PCI ISO HIPAA and surface any gaps to the FDE Lead Required Skills and Experience 6 plus years application security or DevSecOps engineering experience Hands on with at least two of Checkmarx Prisma Cloud Veracode Snyk SonarQube security profiles Working knowledge of at least one compliance framework SOC 2 PCI DSS HIPAA ISO 27001 Container image scanning and IaC scanning experience Trivy Checkov tfsec kube bench helpful Comfortable building executive facing reporting able to talk policy with security leadership and tooling with developers Flowsource Tooling and Tech Stack SAST Checkmarx SCA Prisma Cloud Application security testing Veracode Container image scanning and IaC scanning toolchains Flowsource pipeline security gates and compliance dashboards Success Metrics Percentage of pipelines with mandatory security gates enforced Mean time to remediate critical high findings Open critical severity findings trend must trend down Audit evidence completeness for in scope applications Number of policy exceptions must remain bounded and time limited Cognizant is an equal prospect employer. All qualified applicants will receive consideration for employment without regard to sex, gender identity, sexual orientation, race, color, religion, national origin, disability, protected Veteran status, age, or any other characteristic protected by law.

📌 Architect (Mumbai)
🏢 Cognizant
📍 Mumbai