Senior DevSecOps Engineer - AI Security & Pipelines

NCS; Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Job summary

NCS Australia is seeking a hands-on DevScope SME / Senior DevSecOps Engineer to design, implement and roll out application security scanning standards across enterprise pipelines. You will own defining security scanning boundaries, establishing quality gates, and automating security controls within active CI/CD pipelines.

This delivery-focused role requires building and deploying SAST, SCA, and DAST tooling (Checkmarx, SonarQube, Veracode, Snyk, Fortify, or OWASP ZAP) across enterprise repos,

Qualifications

• Proven Implementation track record: building, configuring, and deploying enterprise SAST, SCA, and DAST tooling.
• DevSecOps Automation: strong hands-on experience integrating AppSec into automated CI/CD pipelines.
• AppSec & Vulnerability Management: deep understanding of OWASP Top 10, CWE, OSS risk, and dep vulnerability mgmt.
• Scripting & Integration: proficient in Python, Bash, PowerShell; APIs to automate scanning workflows.
• Location: based in Sydney or willing to work hybrid in Sydney.

Responsibilities

• Platform Implementation & Roll-Out: lead end-to-end configuration, deployment, and integration of code scanning platforms across enterprise repos.
• SAST, SCA & DAST Governance: establish baseline rulesets, policy standards, and enforcement mechanisms.
• Pipeline Security Automation: embed automated security tests, gates, and failure conditions in CI/CD pipelines.
• Dev Scope & Triage Strategy: define security scanning scope, triage false positives, optimize rulesets.
• Engineering Enablement: collaborate with engineering squads to guide remediation and codify secure coding standards.

Skills

SAST

SCA

DAST

Python

Bash

PowerShell

CI/CD

GitLab CI

GitHub Actions

Azure DevOps

Jenkins

OWASP

APIs

Tools

Checkmarx

SonarQube

Veracode

Snyk

Fortify

OWASP ZAP

Job description

NCS Australia is seeking a hands-on DevScope SME / Senior DevSecOps Engineer to design, implement and roll out application security scanning standards across enterprise pipelines. You will own defining security scanning boundaries, establishing quality gates, and automating security controls within active CI/CD pipelines.

This delivery-focused role requires building and deploying SAST, SCA, and DAST tooling (Checkmarx, SonarQube, Veracode, Snyk, Fortify, or OWASP ZAP) across enterprise repos,