Business Analyst – Application Security (SAST/SCA)

XPT Software; Melbourne; On-site; AUD 120,000 - 160,000; Full time

Job summary

XPT Software Australia is seeking a Mid-to-Senior Business Analyst for an Application Security role focused on embedding SAST and SCA across GitLab SaaS and Self-Managed environments. You will coordinate security, engineering, and platform teams to map current SDLC, define requirements, and design rollout plans.

You will document the vulnerability-management workflow, craft user stories with acceptance criteria, and produce a RAID log and rollout sequencing for phased deployment across estates.

Qualifications

• Understanding of SAST vs SCA vs DAST and secrets detection.
• Familiarity with GitLab CI/CD concepts and pipelines.
• Knowledge of GitLab licensing tiers and feature availability.
• Vulnerability management lifecycle concepts (CVSS, CWE, OWASP).
• Experience writing requirements and user stories for tool deployments.
• Strong facilitation across security, engineering and platform teams.
• Ability to validate feasibility with technical SMEs.

Responsibilities

• Run discovery to map current SDLC, GitLab topology, CI/CD patterns, and existing scanners.
• Document functional and non-functional requirements for SAST/SCA coverage and scope.
• Produce a build-vs-buy/tool-selection matrix for GitLab-native vs third-party tools.
• Define vulnerability management workflow and mapping to GitLab dashboards.
• Write user stories and acceptance criteria for pipeline integration and reporting.
• Own RAID log, RACI, and rollout sequencing plan (pilot to fleet-wide).
• Support change management including communications and adoption metrics.
• Liaise with SME and AI Expert to reflect tool capabilities in requirements.

Tools

GitLab CI/CD

Job description

Business Analyst – Application Security (SAST/SCA)

• XPT SoftwareAustralia PTY Ltd, incorporated in 2016, is a Software Services company
• XPT works with topclients across Australia in Banking, Insurance, Telecom,Retail, Energy, Mining and Manufacturingdomains.
• We have 120+technocrats in Australia working at our clientlocations.
• XPT SoftwareAustralia is part of group companies which has globalpresence across India & Europe.
• We have served100+ clients globally, fulfilling their onsite-offshoreneeds.

Act as the bridge between thecybersecurity team, engineering/DevOps teams, and the SME/AI Expert on thisinitiative, translating the business need (“introduce SAST and SCA acrossGitLab SaaS and GitLab On-Prem”) into a structured requirements, rollout, andgovernance framework. This requires enough working knowledge of AppSec scanningconcepts and GitLab's CI/CD model to write requirements an engineer or vendorcan act on without a long clarification loop.

Key Responsibilities

• Run discovery across engineering, platform, andsecurity stakeholders to map current-state SDLC, GitLab topology (SaaSgroups/projects vs. Self-Managed instances), CI/CD pipeline patterns, andexisting scanning tools (if any) across the telco's project portfolio.
• Document functional and non-functional requirementsfor SAST and SCA (dependency scanning) coverage — language/framework coverage,false-positive tolerance, scan performance/pipeline latency impact, and whethersecrets/container scanning are in scope.
• Produce a build-vs-buy / tool-selection matrixcomparing GitLab-native SAST/SCA (Free/Premium/Ultimate tiering) againstthird-party SAST/SCA tools, and identify where GitLab On-Prem versionconstraints affect feature availability versus SaaS.
• Define the vulnerability management workflow: finding→ triage → issue → remediation MR → SLA tracking, and how this maps intoGitLab's vulnerability management dashboard versus existing ITSM/ticketingtools.
• Write user stories/acceptance criteria for pipelineintegration, exception/waiver processes, developer notification flows, andreporting/dashboards for CISO-level visibility.
• Own the RAID log, stakeholder RACI, and rolloutsequencing plan (pilot teams → phased fleet-wide rollout across SaaS andOn-Prem estates).
• Support change management: developer communication,training material coordination, and adoption metrics (scan coverage %, MTTR onfindings, false-positive rate trend).
• Liaise directly with the SME and AI Expert roles toensure requirements reflect real tool capability and constraints rather thanassumptions.

Experience Level

Mid-to-Senior, 6–10 yearstotal BA experience, with at least 2–3 years specifically in cybersecurity,DevSecOps, or platform engineering programmes. Telco or large regulated-enterpriseexperience is a strong plus given data governance and change-control overhead.

Requirements

Required Knowledge & Skills

• Working understanding of SAST vs. SCA vs. DAST vs.secrets detection — what each catches and doesn't.
• Familiarity with GitLab CI/CD concepts (pipelines,merge requests, .gitlab-ci.yml) — doesn't need to write pipeline code, but mustread and reason about one.
• Understanding of GitLab licensing tiers(Free/Premium/Ultimate) and how SAST/SCA feature availability differs acrossthem.
• Vulnerability management lifecycle and commonframeworks (CVSS scoring, CWE, OWASP Top 10) at working-fluency level, notexpert depth.
• Experience writing requirements/user stories fortooling or platform rollouts (not just business-process BA work).
• Strong stakeholder facilitation skills — thisprogramme spans security, engineering, and platform teams who often havecompeting priorities.
• Comfortable working with technical SMEs to validatefeasibility rather than dictating requirements in isolation.