Senior AppSec Architect — SAST/SCA Rollout Lead

XPT Software; Sydney; On-site; AUD 180,000 - 240,000; Full time

Job summary

XPT Software is seeking a Senior SME-App Security to own the design, standards, and hands-on delivery of SAST/SCA across GitLab SaaS and On-Prem. This role requires deep expertise in secure SDLC, vulnerability management, architecture review, and developer enablement, focused on a high-impact security rollout for its initiative.

You will define target-state architecture, set policies, review pipelines, and enable engineers through training and documentation to sustain secure practices after

Qualifications

• Deep knowledge of SAST, SCA, DAST, and secrets detection; internals of analyzers.
• Hands-on experience with GitLab native security scanning across SaaS and Self-Managed.
• Experience with at least one major third-party SAST/SCA tool for build-vs-buy decisions.
• CI/CD pipeline engineering fluency; ability to review .gitlab-ci.yml and assess impact.
• Strong understanding of vulnerability scoring and prioritization (CVSS, EPSS, CWE).
• Secure design fundamentals including authN/authZ and threat modeling (STRIDE).
• Excellent communication for developer training and cross-team escalation.

Responsibilities

• Assess SDLC and CI/CD architecture for SaaS and On-Prem instances.
• Define target-state SAST/SCA architecture and coverage gaps; assess Third-party tools if needed.
• Review pipeline and repo structure for security-relevant design issues.
• Set scanning policy: severity thresholds, gates, exemptions, and false-positives management.
• Define secure coding standards and guardrails against OWASP ASVS and CWE.
• Design vulnerability triage and remediation workflow with SLAs by severity.
• Provide technical input for vendor evaluations and sign-off on rollout readiness.
• Deliver secure coding and remediation training for engineering teams.

Skills

SAST

SCA

DAST

Vulnerability management

CI/CD security

Secure SDLC

Threat modeling

Developer enablement

CVSS/EPSS

Tools

GitLab security scanning

Advanced SAST

Dependency scanning

Secrets detection

Third-party SAST/SCA tool

Job description

XPT Software is seeking a Senior SME-App Security to own the design, standards, and hands-on delivery of SAST/SCA across GitLab SaaS and On-Prem. This role requires deep expertise in secure SDLC, vulnerability management, architecture review, and developer enablement, focused on a high-impact security rollout for its initiative.

You will define target-state architecture, set policies, review pipelines, and enable engineers through training and documentation to sustain secure practices after