Cybersecurity Engineer - SAST Engineer​/DevOps

Company: Truist Financial
Location: Atlanta, GA
Employment Type: Full Time
Date Posted: 02/14/2026
Job Categories: Banking, Finance/Economics, Information Technology

Language Fluency: English (Required)

Work Shift: 1st shift (United States of America)

The SAST Engineer/Analyst is responsible for reviewing proposed source code related security mitigations, providing troubleshooting support for scan related activities, SAST tool specific CI/CD pipeline guidance, creating and managing Vera Code user accounts, teams, business units, assigning appropriate roles, and ensuring the smooth operation of the SAST tooling for the organization.

*** For this opportunity, Truist will not sponsor an applicant for work visa status or employment authorization, nor will we offer any immigration-related support for this position (including, but not limited to H-1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN-1 or TN-2, E-3, O-1, or future sponsorship for U.S. lawful permanent residence status.)***

• Review proposed mitigations and verify that they effectively address identified vulnerabilities.
• Identify any challenges or issues that might be related to Vera Code SAST scans.
• Working with organizational stakeholders (Developers, Mitigation team, BISMs) to ensure they understand and can follow established procedures.
• Provide troubleshooting support for scan related activities.
• Stay up-to-date with the latest information related to application security and source code review.
• Review and potentially implement upcoming and new opportunities to improve the effectiveness of the SAST program (e.g. Vera Code releases new functionality such as Container scanning).
• Assist with identification and execution of program improvement opportunities.
• Manage day to day SAST related activities such as account, team, and application management.
• Provide SAST process related training for development teams.
• Continually improve the SAST program.
• Provide automation of repeatable tasks.
• Create and manage actionable metrics.
• Communicate changes and status to stakeholders.

Required Qualifications:

• Bachelors degree and five years of experience in systems engineering or administration or an equivalent combination of education and work experience.
• In-depth knowledge in applied enterprise information security technologies including but not limited to firewalls, intrusion detection/prevention systems, network operating systems, identity management, database activity monitoring, encryption, content filtering, and Mainframe security.
• Previous experience in planning and managing IT projects.

Preferred Qualifications/Skills/Abilities:

• Proficiency in using SAST and SCA tooling.
• Understand software development and testing methodologies and continuous integration/continuous delivery (CI/CD).
• Understand static analysis tools and techniques especially if they are up to date on some of the generative ai capabilities.
• Program language knowledge for commonly used languages such as C#, Java, Python, and JavaScript.
• Familiarity with common code deployment methods and automation tools such as Jenkins.
• Web application security knowledge and an understanding of the most common web application security vulnerabilities.
• An understanding of the SAST and SCA process - what it is, why it is used, and when.
• An understanding of the abilities and limitations of SAST tooling.
• Knowledge of the software development life cycle, especially in areas of code development, testing, and deployment.
• Experience working with different frameworks such as NIST and OWASP.
• An understanding of different data sensitivity classification types such as personally identifiable information.
• Excellent communication skills.
• In-depth knowledge of application security vulnerabilities and how to mitigate them.
• Ability to work independently and as part of a team.
• Time management and organizational skills.

Sitting

Constantly (More than 50% of the time)

Visual / Audio / Speaking

Able to access and interpret client information received from the computer and able to hear and speak with individuals in person and…