Checmarx Issue: The web-application does not define an HSTS header, leaving it vulnerable to attack

I am getting the following error in checkmarx (asp.net core application):

The web-application does not define an HSTS header, leaving it vulnerable to attack.

Although I have the following code in my app:

services.AddHsts(options => { options.IncludeSubDomains = true; options.MaxAge = TimeSpan.FromDays(365); });

And:

application.UseHsts();

What am I missing here?