Application Security BA - SAST/SCA & GitLab Rollout Lead

XPT Software Australia Pty Ltd; Sydney; On-site; AUD 110,000 - 140,000; Full time

Job summary

XPT Software Australia Pty Ltd in Sydney seeks a Mid-to-Senior Business Analyst to bridge cybersecurity, engineering and SME roles, translating business needs into structured requirements for SAST and SCA across GitLab SaaS and On-Prem environments. You will map the current SDLC, assess GitLab topology, define the vulnerability management workflow, and write user stories with acceptance criteria.

The role spans security, engineering and platform teams, with rollout sequencing from pilots to

Qualifications

• Experience with SAST/SCA and DAST concepts.
• Understand GitLab CI/CD concepts and licensing.
• Familiar with vulnerability mgmt frameworks (CVSS, CWE, OWASP).
• Ability to write requirements and user stories for tooling rollouts.
• Strong stakeholder facilitation across security, engineering, and platform teams.

Responsibilities

• Map current-state SDLC and GitLab topology across SaaS and On-Prem.
• Document functional and non-functional SAST/SCA coverage requirements.
• Produce a tool-selection matrix comparing GitLab vs third-party tools.
• Define vulnerability management workflow and dashboards.
• Write acceptance criteria and rollout sequencing plan.

Skills

SAST vs SCA basics

GitLab CI/CD concepts

Licensing tiers

Vulnerability management lifecycle

Writing requirements/User stories

Stakeholder facilitation

Technical SME collaboration

Education

Bachelor's degree in IT / CS

Tools

GitLab

OWASP knowledge

Job description

XPT Software Australia Pty Ltd in Sydney seeks a Mid-to-Senior Business Analyst to bridge cybersecurity, engineering and SME roles, translating business needs into structured requirements for SAST and SCA across GitLab SaaS and On-Prem environments. You will map the current SDLC, assess GitLab topology, define the vulnerability management workflow, and write user stories with acceptance criteria.

The role spans security, engineering and platform teams, with rollout sequencing from pilots to