SME-App Security with SAST/SCA

XPT Software Australia; Sydney; Presencial; AUD 150.000 - 230.000; Jornada completa

Descripción de la vacante

XPT Software Australia is seeking a Senior SME-App Security to own the design and delivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem. This role requires deep AppSec expertise, secure SDLC design, vulnerability management, and architectural review, focused on a high-impact, time-limited initiative.

You will define architecture, policy, and triage workflows, provide training and documentation, and secure sign-off for rollout readiness across both SaaS and self-managed

Formación

• Senior level, 8+ years in application security or secure software engineering.
• Hands-on with SAST/SCA tooling on SaaS and Self-Managed GitLab environments.
• Ability to perform architecture reviews and developer enablement.

Responsabilidades

• Assess current SDLC and CI/CD pipeline architecture across GitLab SaaS and On-Prem, including On-Prem versioning.
• Define target-state SAST/SCA architecture and coverage.
• Review pipeline structures for security design issues (authN/authZ, trust boundaries).
• Set scanning policy, severity thresholds, and gate criteria.
• Define secure coding standards aligned with OWASP ASVS/CWE, scoped to languages/frameworks.
• Design vulnerability triage, remediation SLAs, and tie-ins to ticketing/GRC tooling.
• Validate BA-authored requirements and contribute to vendor evaluation if needed.
• Perform root-cause analysis on recurring findings and adjust configurations.
• Provide technical sign-off for rollout readiness and conduct secure coding training.
• Create internal docs and runbooks for post-engagement support.
• Document architecture decisions for the client's security team.

Conocimientos

SAST/SCA tooling

SAST

SCA

DAST

secret detection

GitLab native security scanning

CI/CD pipelines

vulnerability scoring

STRIDE threat modeling

communication

architecture review

developer enablement

security training

Herramientas

GitLab Advanced SAST

GitLab Dependency Scanning

Third-party SAST/SCA tools

GitLab CI/CD

Descripción del empleo

Position: SME-App Security

Team: Cybersecurity - Application Security Engineering

Role Purpose

Own the technical design, standards, and hands-on delivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem. This role carries the full depth of an AppSec Specialist's skillset - secure SDLC design, vulnerability management discipline, architecture review, developer enablement - but applied narrowly and intensively to this one initiative for its duration, rather than as an ongoing cross-portfolio function.

Position: SME-App Security

Team: Cybersecurity - Application Security Engineering

Role Purpose

Own the technical design, standards, and hands-on delivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem. This role carries the full depth of an AppSec Specialist's skillset - secure SDLC design, vulnerability management discipline, architecture review, developer enablement - but applied narrowly and intensively to this one initiative for its duration, rather than as an ongoing cross-portfolio function.

Key Responsibilities

• Assess current SDLC and CI/CD pipeline architecture across both GitLab SaaS and Self-Managed/On-Prem instances, including version currency on the On-Prem side.
• Stakeholder management as there are different owners for Gitlab SaaS and Gitlab OnPrem
• Define the target-state SAST/SCA architecture: which GitLab-native features to use (Advanced SAST, dependency scanning, container/secrets scanning if in scope), where coverage gaps exist, and whether a third-party tool is required to close them.
• Review pipeline and repo structure for security-relevant design issues (authN/authZ patterns, trust boundaries, dependency exposure) uncovered during rollout.
• Set scanning policy for the initiative: severity thresholds, blocking vs. non-blocking pipeline gates, exception/waiver criteria, and false-positive management approach.
• Define secure coding standards and guardrails scanning results should be measured against (e.g., OWASP ASVS, CWE Top 25), scoped to the languages/frameworks in this rollout.
• Design the vulnerability triage and remediation workflow, including SLAs by severity, and how findings map into existing ticketing/GRC tooling.
• Validate feasibility of BA-authored requirements before they're finalized; provide technical input into vendor evaluation/RFP if a third-party tool is shortlisted.
• Perform root-cause analysis on recurring finding patterns surfaced during pilot rollout, and adjust scanning configuration/rules accordingly.
• Provide technical sign-off on rollout readiness per team/project before scanning gates go live.
• Run secure coding and remediation training for engineering teams as scanning gates go live for their projects.
• Build lightweight internal documentation/reference material so teams can self-serve common remediation patterns after the SME's engagement ends.
• Document architecture decisions, policy rationale, and configuration standards in a form the client's ongoing security team can operate and extend after the fixed-term engagement concludes.

Experience Level

Senior, 8+ years in application security / secure software engineering, with at least 4-5 years hands-on with SAST/SCA tooling specifically, and prior experience in AppSec practice broadly enough to bring architecture review and developer enablement skills, not just scanner configuration.

Required Knowledge & Skills

• Deep working knowledge of SAST, SCA, DAST, and secrets detection - internals of how static analyzers work, not just tool operation.
• Hands-on experience with GitLab's native security scanning (Advanced SAST, dependency scanning) across both SaaS and Self-Managed, including feature parity gaps between tiers/versions.
• Practical experience with at least one major third-party SAST/SCA tool to inform build-vs-buy decisions credibly.
• CI/CD pipeline engineering fluency - able to write/review .gitlab-ci.yml and reason about pipeline performance impact.
• Strong grasp of vulnerability scoring/prioritization (CVSS, EPSS, CWE) and experience avoiding alert fatigue in high-volume scanning environments.
• Secure design fundamentals - authN/authZ, threat modeling (e.g., STRIDE) - sufficient to review architecture surfaced during rollout.
• Strong communication skills for developer training and cross-team escalation handling.
• Telco or critical-infrastructure security experience is a strong plus given regulatory and change-control constraints.

Nice to Have

• Relevant certifications: OSCP, GWAPT, CSSLP, or equivalent.
• Experience running a phased SAST/SCA rollout across a large multi-team, multi-repo GitLab estate (100+ projects).
• Experience structuring handover documentation/runbooks for fixed-term security engagements.