Business Analyst — Application Security & GitLab SAST/SCA

XPT Software; Melbourne; In loco; AUD 120.000 - 160.000; Tempo pieno

Descrizione del lavoro

XPT Software Australia is seeking a Mid-to-Senior Business Analyst for an Application Security role focused on embedding SAST and SCA across GitLab SaaS and Self-Managed environments. You will coordinate security, engineering, and platform teams to map current SDLC, define requirements, and design rollout plans.

You will document the vulnerability-management workflow, craft user stories with acceptance criteria, and produce a RAID log and rollout sequencing for phased deployment across estates.

Competenze

• Understanding of SAST vs SCA vs DAST and secrets detection.
• Familiarity with GitLab CI/CD concepts and pipelines.
• Knowledge of GitLab licensing tiers and feature availability.
• Vulnerability management lifecycle concepts (CVSS, CWE, OWASP).
• Experience writing requirements and user stories for tool deployments.
• Strong facilitation across security, engineering and platform teams.
• Ability to validate feasibility with technical SMEs.

Mansioni

• Run discovery to map current SDLC, GitLab topology, CI/CD patterns, and existing scanners.
• Document functional and non-functional requirements for SAST/SCA coverage and scope.
• Produce a build-vs-buy/tool-selection matrix for GitLab-native vs third-party tools.
• Define vulnerability management workflow and mapping to GitLab dashboards.
• Write user stories and acceptance criteria for pipeline integration and reporting.
• Own RAID log, RACI, and rollout sequencing plan (pilot to fleet-wide).
• Support change management including communications and adoption metrics.
• Liaise with SME and AI Expert to reflect tool capabilities in requirements.

Strumenti

GitLab CI/CD

Descrizione del lavoro

XPT Software Australia is seeking a Mid-to-Senior Business Analyst for an Application Security role focused on embedding SAST and SCA across GitLab SaaS and Self-Managed environments. You will coordinate security, engineering, and platform teams to map current SDLC, define requirements, and design rollout plans.

You will document the vulnerability-management workflow, craft user stories with acceptance criteria, and produce a RAID log and rollout sequencing for phased deployment across estates.