Strategic AppSec BA for SAST/SCA GitLab Rollout

XPT Software; Sydney; On-site; AUD 120,000 - 170,000; Full time

Job summary

XPT Software in Sydney is seeking a mid-to-senior Business Analyst to bridge cybersecurity, engineering, and SME/AI Expert teams for introducing SAST and SCA across GitLab SaaS and On-Prem implementations.

You will map the SDLC, document requirements, craft rollout and governance, and produce user stories and acceptance criteria for pipeline integration, dashboards, and executive reporting. A RAID log and cross-team coordination are essential to success.

Qualifications

• Knowledge of SAST vs SCA vs DAST and secrets detection and limitations.
• Ability to read and reason about GitLab pipelines and .gitlab-ci.yml.
• Understanding licensing tiers and feature availability across GitLab editions.
• Familiarity with vulnerability management lifecycles and standards (CVSS/CWE/OWASP).

Responsibilities

• Run discovery across stakeholders to map current SDLC and GitLab topology.
• Document requirements for SAST/SCA coverage, latency, and scope of secrets scanning.
• Create a tool-selection matrix comparing GitLab native vs third-party tools.
• Define vulnerability workflow: finding, triage, issue, remediation MR, SLA tracking.
• Write user stories and acceptance criteria for pipeline integration and reporting dashboards.
• Own RAID log, RACI, and rollout sequencing from pilot to full-scale rollout.
• Support change management with training materials and adoption metrics.

Skills

SAST & SCA knowledge

GitLab CI/CD concepts

GitLab licensing tiers

Vulnerability management lifecycle

Requirements/User stories

Stakeholder facilitation

SME collaboration

Job description

XPT Software in Sydney is seeking a mid-to-senior Business Analyst to bridge cybersecurity, engineering, and SME/AI Expert teams for introducing SAST and SCA across GitLab SaaS and On-Prem implementations.

You will map the SDLC, document requirements, craft rollout and governance, and produce user stories and acceptance criteria for pipeline integration, dashboards, and executive reporting. A RAID log and cross-team coordination are essential to success.