Business Analyst - Sec ops

Acira Consultancy Pty Ltd; Geehi; On-site; AUD 120,000 - 170,000; Full time

Job summary

Acira Consultancy Pty ltd is seeking a senior BA to bridge cybersecurity, engineering, and governance for introducing SAST and SCA across GitLab SaaS and On-Prem. You will translate business needs into structured requirements, rollout plans, and governance with clear success criteria.

You will map current-state SDLC, define functional and non-functional requirements, and create rollout sequencing from pilots to enterprise-wide deployment across SaaS and Self-Managed GitLab estates.

Qualifications

• 6–10 years total BA experience, with 2–3 years in cybersecurity/DevSecOps.
• Experience in telco or regulated environments preferred.
• Understanding of SAST/SCA/DAST and secrets detection.
• Familiarity with GitLab CI/CD concepts and pipeline code.
• Knowledge of GitLab licensing tiers and feature availability.
• Familiarity with vulnerability management frameworks (CVSS, CWE, OWASP).
• Experience writing requirements/user stories for tooling rollouts.
• Strong stakeholder facilitation across security, engineering and platform teams.

Responsibilities

• Map current-state SDLC and GitLab topology across teams and tools.
• Document SAST/SCA requirements: language coverage, FP tolerance, latency.
• Produce build-vs-buy matrix for GitLab vs third-party tools.
• Define vulnerability management workflow and ITSM mapping.
• Write user stories and acceptance criteria for pipeline integration.
• Own RAID log, RACI, and rollout sequencing from pilots to full rollout.
• Support change management with comms, training, and adoption metrics.
• Liaise with SME and AI Expert to reflect real tool capabilities.

Skills

BA experience

Cybersecurity

DevSecOps

Platform engineering

Telco/regulated domain

GitLab CI/CD

SAST/SCA knowledge

Vulnerability frameworks

Stakeholder facilitation

Requirements writing

Tools

GitLab

Job description

Act as the bridge between the cybersecurity team, engineering/DevOps teams, and the SME/AI Expert on this initiative, translating the business need (introduce SAST and SCA across GitLab SaaS and GitLab On-Prem) into a structured requirements, rollout, and governance framework. This requires enough working knowledge of AppSec scanning concepts and GitLab's CI/CD model to write requirements an engineer or vendor can act on without a long clarification loop.

Key responsibilities

Run discovery across engineering, platform, and security stakeholders to map current-state SDLC, GitLab topology (SaaS groups/projects vs. Self-Managed instances), CI/CD pipeline patterns, and existing scanning tools across the telco's project portfolio.

Document functional and non-functional requirements for SAST and SCA (dependency scanning) coverage — language/framework coverage, false-positive tolerance, scan performance/pipeline latency impact, and whether secrets/container scanning are in scope.

Produce a build-vs-buy / tool-selection matrix comparing GitLab-native SAST/SCA (Free/Premium/Ultimate tiering) against third-party SAST/SCA tools, and identify where GitLab On-Prem version constraints affect feature availability versus SaaS.

Define the vulnerability management workflow: finding → triage → issue → remediation MR → SLA tracking, and how this maps into GitLab's vulnerability management dashboard versus existing ITSM/ticketing tools.

Write user stories/acceptance criteria for pipeline integration, exception/waiver processes, developer notification flows, and reporting/dashboards for CISO-level visibility.

Own the RAID log, stakeholder RACI, and rollout sequencing plan (pilot teams → phased fleet-wide rollout across SaaS and On-Prem estates).

Support change management: developer communication, training material coordination, and adoption metrics (scan coverage %, MTTR on findings, false-positive rate trend).

Liaise directly with the SME and AI Expert roles to ensure requirements reflect real tool capability and constraints rather than assumptions.

About you

Mid-to-Senior level with 6–10 years total BA experience, with at least 2–3 years specifically in cybersecurity, DevSecOps, or platform engineering programmes.

Telco or large regulated-enterprise experience is a strong plus given data governance and change-control overhead.

Working understanding of SAST vs. SCA vs. DAST vs. secrets detection — what each catches and doesn't.

Familiarity with GitLab CI/CD concepts (pipelines, merge requests, .gitlab-ci.yml) — must read and reason about pipeline code.

Understanding of GitLab licensing tiers (Free/Premium/Ultimate) and how SAST/SCA feature availability differs across them.

Vulnerability management lifecycle and common frameworks (CVSS scoring, CWE, OWASP Top 10) at working-fluency level.

Experience writing requirements/user stories for tooling or platform rollouts.

Strong stakeholder facilitation skills — this programme spans security, engineering, and platform teams who often have competing priorities.

Comfortable working with technical SMEs to validate feasibility rather than dictating requirements in isolation.

Prior exposure to GitLab Self-Managed vs. SaaS migration or dual-topology environments is a plus.