DevSecOps Business Analyst

XPT Software Australia; Sydney; On-site; AUD 110,000 - 160,000; Full time

Job summary

XPT Software Australia is seeking a DevSecOps Business Analyst in Sydney to gather and document business, security, and compliance requirements for secure software delivery. You will work with development, security, QA, and operations teams to shape CI/CD security, SAST, SCA, and remediation processes.

You will translate requirements into user stories and specifications, facilitate security workshops, and help onboarding of applications into DevSecOps toolchains, focusing on automation,

Qualifications

• Gather, analyze, and document business, security, and compliance requirements for DevSecOps initiatives and secure software development practices.

Responsibilities

• Collaborate with development, security, QA, and operations teams to define requirements for CI/CD security controls, Secure Code Scanning (SAST), Software Composition Analysis (SCA), and vulnerability remediation processes.
• Translate business and security requirements into user stories, process flows, functional specifications, and acceptance criteria.
• Facilitate workshops with stakeholders to identify security risks, control gaps, and opportunities for automation across the Software Development Lifecycle (SDLC).
• Support onboarding of applications into DevSecOps toolchains, including secure code scanning, secrets management, container security, and compliance monitoring solutions.
• Track and report security findings, remediation status, risk exceptions, and compliance metrics while ensuring alignment with governance requirements.
• Prepare SOPs, process documentation, dashboards, and executive reports to drive continuous improvement and DevSecOps maturity across the organization.

Job description

Job description:

DevSecOps Business Analyst

• Gather, analyze, and document business, security, and compliance requirements for DevSecOps initiatives and secure software development practices.
• Collaborate with development, security, QA, and operations teams to define requirements for CI/CD security controls, Secure Code Scanning (SAST), Software Composition Analysis (SCA), and vulnerability remediation processes.
• Translate business and security requirements into user stories, process flows, functional specifications, and acceptance criteria.
• Facilitate workshops with stakeholders to identify security risks, control gaps, and opportunities for automation across the Software Development Lifecycle (SDLC).
• Support onboarding of applications into DevSecOps toolchains, including secure code scanning, secrets management, container security, and compliance monitoring solutions.
• Track and report security findings, remediation status, risk exceptions, and compliance metrics while ensuring alignment with governance requirements.
• Prepare SOPs, process documentation, dashboards, and executive reports to drive continuous improvement and DevSecOps maturity across the organization.