Static Analysis SAST Rollout on a Fintech Codebase

FreeVerified credential3 weeksAdvanced

Overview

What this challenge is about.

Static Analysis SAST Rollout on a Fintech Codebase. Advanced challenge in code. Writing production code that solves real engineering problems, earn a blockch...

CredentialBlockchain-anchored

ShareableLinkedIn-ready

LanguageEnglish

PaceSelf-paced

The Brief

What you'll do, and what you'll demonstrate.

Roll out SAST across 18 services for a fintech codebase, tune to under 5 percent false-positive rate, and integrate into developer workflow without alert fatigue.

This is not a coding exercise. It is the work a software engineer does between a Jira ticket and a merged PR. That distinction matters to every hiring manager who has seen candidates solve LeetCode problems and none who have shipped production code under real constraints.

When you finish, you will have something most graduates do not: a real-world deliverable, verified by Ewance, that you can show to a hiring manager and say "I did this. Here is the proof."

Earning criteria — what you'll demonstrate

Run baseline SAST across a multi-language polyglot codebase
Tune rulesets to acceptable false-positive rate (the actual hard part)
Integrate SAST as PR-blocking + advisory without alert fatigue
Hand off rule maintenance + escalation to the security team

Program Fit

Where this fits in your program.

Sharpens the same skills your degree expects you to demonstrate.

Aligned coursework coming soon.

Skills

Skills you'll demonstrate.

Each one shows up on your verified credential.

Careers

Career paths this challenge builds toward

Completing this challenge demonstrates skills that transfer directly to these roles:

Career paths this builds toward

Canonical roles

Security Engineer
If a security analyst watches for fires, a security engineer builds the systems that make fires harder to start. The work is architectural: designing Zero Trust networks, hardening CI/CD pipelines against supply chain attacks, choosing cryptographic primitives that won't be regretted in five years. You hold an adversarial mindset in one hand and an empathy for developer workflow in the other, because controls that engineers route around aren't really controls. Frameworks like OWASP and the MITRE ATT&CK catalog give you a shared language with the rest of the field. Students drawn to this path usually liked the puzzles in a CTF more than the prizes. Growth comes from owning a real production environment and writing the post-mortem when something you missed went wrong.
Security

One more thing

You can put a credential on your CV by Friday.

Start this challenge