Senior DevSecOps Engineer - Secure CI/CD & SAST/DAST

NCS Group; City of Melbourne; Hybrid; AUD 150,000 - 185,000; Full time

Job summary

NCS Australia is seeking a hands-on DevScope SME / Senior DevSecOps Engineer to drive security scanning standards across enterprise pipelines. You will own the design, implementation and rollout of SAST, SCA and DAST platforms, embedding checks directly into CI/CD workflows and defining false-positive triage strategies.

Based in Sydney with hybrid work options, you will collaborate with software engineering squads to enable secure coding, establish security gates, and automate reporting across

Qualifications

• Proven implementation track record deploying enterprise SAST, SCA and DAST tooling.
• DevSecOps automation in automated CI/CD pipelines and developer tools.
• Deep understanding of OWASP Top 10, CWE, OSS risk and dependency vulnerability management.
• Scripting in Python, Bash or PowerShell with API integrations.
• Location: Based in Sydney with Australian working rights and hybrid work in Sydney.

Responsibilities

• Platform implementation and rollout of code scanning platforms across enterprise repositories.
• Governance for SAST, SCA & DAST including baseline rulesets and enforcement.
• Embed security testing stages and quality gates into CI/CD pipelines (GitLab CI, GitHub Actions, Azure DevOps, Jenkins).
• Define Dev Scope and triage strategy to minimize friction while maintaining security coverage.
• Enable engineers with secure coding standards and developer-first security practices.

Skills

DevSecOps

CI/CD

Scripting

Vulnerability

OWASP Top 10

Tools

Checkmarx

SonarQube

Veracode

Snyk

Fortify

OWASP ZAP

GitLab CI

GitHub Actions

Azure DevOps

Jenkins

Job description

NCS Australia is seeking a hands-on DevScope SME / Senior DevSecOps Engineer to drive security scanning standards across enterprise pipelines. You will own the design, implementation and rollout of SAST, SCA and DAST platforms, embedding checks directly into CI/CD workflows and defining false-positive triage strategies.

Based in Sydney with hybrid work options, you will collaborate with software engineering squads to enable secure coding, establish security gates, and automate reporting across