Senior AppSec SME: SAST/SCA Architect & Rollout Lead

XPT Software Australia; Sydney; On-site; AUD 150,000 - 230,000; Full time

Job summary

XPT Software Australia is seeking a Senior SME-App Security to own the design and delivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem. This role requires deep AppSec expertise, secure SDLC design, vulnerability management, and architectural review, focused on a high-impact, time-limited initiative.

You will define architecture, policy, and triage workflows, provide training and documentation, and secure sign-off for rollout readiness across both SaaS and self-managed

Qualifications

• Senior level, 8+ years in application security or secure software engineering.
• Hands-on with SAST/SCA tooling on SaaS and Self-Managed GitLab environments.
• Ability to perform architecture reviews and developer enablement.

Responsibilities

• Assess current SDLC and CI/CD pipeline architecture across GitLab SaaS and On-Prem, including On-Prem versioning.
• Define target-state SAST/SCA architecture and coverage.
• Review pipeline structures for security design issues (authN/authZ, trust boundaries).
• Set scanning policy, severity thresholds, and gate criteria.
• Define secure coding standards aligned with OWASP ASVS/CWE, scoped to languages/frameworks.
• Design vulnerability triage, remediation SLAs, and tie-ins to ticketing/GRC tooling.
• Validate BA-authored requirements and contribute to vendor evaluation if needed.
• Perform root-cause analysis on recurring findings and adjust configurations.
• Provide technical sign-off for rollout readiness and conduct secure coding training.
• Create internal docs and runbooks for post-engagement support.
• Document architecture decisions for the client's security team.

Skills

SAST/SCA tooling

SAST

SCA

DAST

secret detection

GitLab native security scanning

CI/CD pipelines

vulnerability scoring

STRIDE threat modeling

communication

architecture review

developer enablement

security training

Tools

GitLab Advanced SAST

GitLab Dependency Scanning

Third-party SAST/SCA tools

GitLab CI/CD

Job description

XPT Software Australia is seeking a Senior SME-App Security to own the design and delivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem. This role requires deep AppSec expertise, secure SDLC design, vulnerability management, and architectural review, focused on a high-impact, time-limited initiative.

You will define architecture, policy, and triage workflows, provide training and documentation, and secure sign-off for rollout readiness across both SaaS and self-managed