Business Analyst – Application Security (SAST/SCA)

XPT Software Australia Pty Ltd; Sydney; On-site; AUD 110,000 - 140,000; Full time

Job summary

XPT Software Australia Pty Ltd in Sydney seeks a Mid-to-Senior Business Analyst to bridge cybersecurity, engineering and SME roles, translating business needs into structured requirements for SAST and SCA across GitLab SaaS and On-Prem environments. You will map the current SDLC, assess GitLab topology, define the vulnerability management workflow, and write user stories with acceptance criteria.

The role spans security, engineering and platform teams, with rollout sequencing from pilots to

Qualifications

• Experience with SAST/SCA and DAST concepts.
• Understand GitLab CI/CD concepts and licensing.
• Familiar with vulnerability mgmt frameworks (CVSS, CWE, OWASP).
• Ability to write requirements and user stories for tooling rollouts.
• Strong stakeholder facilitation across security, engineering, and platform teams.

Responsibilities

• Map current-state SDLC and GitLab topology across SaaS and On-Prem.
• Document functional and non-functional SAST/SCA coverage requirements.
• Produce a tool-selection matrix comparing GitLab vs third-party tools.
• Define vulnerability management workflow and dashboards.
• Write acceptance criteria and rollout sequencing plan.

Skills

SAST vs SCA basics

GitLab CI/CD concepts

Licensing tiers

Vulnerability management lifecycle

Writing requirements/User stories

Stakeholder facilitation

Technical SME collaboration

Education

Bachelor's degree in IT / CS

Tools

GitLab

OWASP knowledge

Job description

XPT Software Australia Pty Ltd | Contract

Business Analyst – Application Security (SAST/SCA)

Sydney, Australia | Posted on 10/22/2026

• XPT SoftwareAustralia PTY Ltd, incorporated in 2016, is a Software Services company
• XPT works with topclients across Australia in Banking, Insurance, Telecom,Retail, Energy, Mining and Manufacturingdomains.
• We have 120+technocrats in Australia working at our clientlocations.
• XPT SoftwareAustralia is part of group companies which has globalpresence across India & Europe
• We have served100+ clients globally, fulfilling their onsite-offshoreneeds.

Job Description

Act as the bridge between thecybersecurity team, engineering/DevOps teams, and the SME/AI Expert on thisinitiative, translating the business need (“introduce SAST and SCA acrossGitLab SaaS and GitLab On-Prem”) into a structured requirements, rollout, andgovernance framework. This requires enough working knowledge of AppSec scanningconcepts and GitLab's CI/CD model to write requirements an engineer or vendorcan act on without a long clarification loop.

Key Responsibilities

• Run discovery across engineering, platform, andsecurity stakeholders to map current-state SDLC, GitLab topology (SaaSgroups/projects vs. Self-Managed instances), CI/CD pipeline patterns, andexisting scanning tools (if any) across the telco's project portfolio.
• Document functional and non-functional requirementsfor SAST and SCA (dependency scanning) coverage — language/framework coverage,false-positive tolerance, scan performance/pipeline latency impact, and whethersecrets/container scanning are in scope.
• Produce a build-vs-buy / tool-selection matrixcomparing GitLab-native SAST/SCA (Free/Premium/Ultimate tiering) againstthird-party SAST/SCA tools, and identify where GitLab On-Prem versionconstraints affect feature availability versus SaaS.
• Define the vulnerability management workflow: finding→ triage → issue → remediation MR → SLA tracking, and how this maps intoGitLab's vulnerability management dashboard versus existing ITSM/ticketingtools.
• Write user stories/acceptance criteria for pipelineintegration, exception/waiver processes, developer notification flows, andreporting/dashboards for CISO-level visibility.
• Own the RAID log, stakeholder RACI, and rolloutsequencing plan (pilot teams → phased fleet-wide rollout across SaaS andOn-Prem estates).
• Support change management: developer communication,training material coordination, and adoption metrics (scan coverage %, MTTR onfindings, false-positive rate trend).
• Liaise directly with the SME and AI Expert roles toensure requirements reflect real tool capability and constraints rather thanassumptions.

Experience Level

Mid-to-Senior, 6–10 yearstotal BA experience, with at least 2–3 years specifically in cybersecurity,DevSecOps, or platform engineering programmes. Telco or large regulated-enterpriseexperience is a strong plus given data governance and change-control overhead.

Requirements

Required Knowledge & Skills

• Working understanding of SAST vs. SCA vs. DAST vs.secrets detection — what each catches and doesn't.
• Familiarity with GitLab CI/CD concepts (pipelines,merge requests, .gitlab-ci.yml) — doesn't need to write pipeline code, but mustread and reason about one.
• Understanding of GitLab licensing tiers(Free/Premium/Ultimate) and how SAST/SCA feature availability differs acrossthem.
• Vulnerability management lifecycle and commonframeworks (CVSS scoring, CWE, OWASP Top 10) at working-fluency level, notexpert depth.
• Experience writing requirements/user stories fortooling or platform rollouts (not just business-process BA work).
• Strong stakeholder facilitation skills — thisprogramme spans security, engineering, and platform teams who often havecompeting priorities.
• Comfortable working with technical SMEs to validatefeasibility rather than dictating requirements in isolation.