Business Analyst – Application Security DevSecOps

Ampstek; Sydney; On-site; AUD 120,000 - 160,000; Full time

Job summary

Ampstek is seeking a Senior Business Analyst with strong AppSec and DevSecOps knowledge to bridge Cybersecurity, Engineering/DevOps, and Platform teams. The role focuses on translating security requirements into structured specifications for GitLab SAST and SCA across SaaS and On-Prem environments.

The candidate will run discovery sessions, define requirements, build governance processes, and support CISO-level reporting with dashboards and metrics.

Qualifications

• 6–10 years of BA experience
• 2–3+ years in Cybersecurity, Application Security, DevSecOps, or Platform Engineering
• Experience translating business and security requirements into actionable specs

Responsibilities

• Conduct discovery with Engineering, Platform, DevOps, and Security teams to map SDLC, GitLab topology, and CI/CD processes
• Define functional and non-functional requirements for SAST and SCA/dependency scanning
• Assess coverage across languages/frameworks, scan performance, and pipeline impact
• Create build-vs-buy and tool-selection matrices for GitLab-native vs third-party scanners
• Map GitLab vulnerability management with ITSM/ticketing platforms
• Create user stories, acceptance criteria, and process documentation
• Define requirements for pipeline integration, exceptions/waivers, and dashboards

Skills

Business analysis

Cybersecurity

DevSecOps

Requirements engineering

Stakeholder management

SDLC

Tools

GitLab

SAST

SCA

CI/CD tooling

ITSM

Job description

Role: Business Analyst – AppSec / DevSecOps / GitLab SAST & SCA

Experience: 6–10 years overall BA experience, with 2–3+ years in Cybersecurity, Application Security, DevSecOps, or Platform Engineering.

Role Purpose

We are looking for a Business Analyst with strong Application Security and DevSecOps knowledge to act as the bridge between Cybersecurity, Engineering/DevOps, Platform teams, and technical SMEs.

The role will translate business and security requirements into structured requirements, rollout plans, governance processes, and implementation frameworks for GitLab SAST and SCA across GitLab SaaS and Self-Managed/On-Prem environments.

Key Responsibilities

• Conduct discovery sessions with Engineering, Platform, DevOps, and Security teams to understand the current SDLC, GitLab topology, CI/CD processes, and existing security scanning tools.
• Define functional and non-functional requirements for SAST and SCA/dependency scanning.
• Assess requirements around programming language/framework coverage, scan performance, pipeline impact, false positives, and security scanning scope.
• Develop build-vs-buy and tool-selection matrices comparing GitLab-native SAST/SCA with third-party security scanning solutions.
• Assess differences between GitLab SaaS and GitLab Self-Managed/On-Prem environments, including version and feature limitations.
• Map GitLab vulnerability management processes with existing ITSM/ticketing platforms.
• Create user stories, functional requirements, acceptance criteria, and process documentation.
• Define requirements for pipeline integration, security exceptions/waivers, developer notifications, dashboards, and reporting.
• Support CISO-level reporting requirements, including scan coverage, vulnerability trends, MTTR, and false-positive rates.
• Maintain RAID logs, RACI matrices, stakeholder maps, and rollout plans.