Senior DevSecOps and Application Security SME

Ian Martin Group; Vancouver; On-site; CAD 103,000 - 127,000; Full time

Job summary

The Ian Martin Group is seeking a Senior DevSecOps and Application Security SME in Vancouver, BC. The role focuses on implementing and optimizing application security across GitHub Enterprise, GHAS, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, and IaC scanning.

The ideal candidate will lead secure CI/CD integration, vulnerability management, and risk-based remediation, while mentoring internal staff and aligning with industry standards and regulatory

Qualifications

• Minimum 7 years IT/Software Eng experience with 5+ years in security.
• 3+ years DevSecOps or AppSec in enterprise environments.
• Hands-on GitHub Enterprise & GHAS implementation experience.
• Experience with CodeQL, SAST, SCA, secret scanning and remediation workflows.
• Ability to integrate security controls into GitHub Actions and Azure DevOps pipelines.
• Familiarity with secure SDLC, OWASP, NERC CIP, ISO 27001/2, NIST, BC FIPPA.

Responsibilities

• Implement and optimize AppSec across GitHub Enterprise, GHAS, GitHub Actions, and Azure DevOps.
• Integrate automated security tests (CodeQL, SAST, SCA, secret scanning) into pipelines.
• Lead secure onboarding and software supply chain risk management.
• Develop repeatable security standards, threat modeling, and governance reporting.
• Provide knowledge transfer and coaching to internal teams.
• Support incident response and security operations during breaches or outages.

Skills

GitHub Enterprise

GHAS

CodeQL

SAST

SCA

CI/CD security

Azure DevOps pipelines

Education

Bachelor's in CS/SE

Tools

Terraform

Bicep

ARM templates

Job description

Senior DevSecOps and Application Security SME

Pay Rate: $82.81/hour, depending on experience

Contract: Start Date2026-12-14 End Date2027-12-11

Location: Vancouver, British Columbia

Raise is currently hiring a Senior DevSecOps and Application Security SME on behalf of our client. They’re expanding their team to meet growing needs, making this a unique opportunity to work with an industry leader. Our Client, is one of the largest electrical energy suppliers in Canada.

Note: The primary pay rate is based on T4 classification; however, we will also consider applications from candidates interested in an INC classification, where applicable.

Description

The Senior DevSecOps and Application Security SME supporting the AppSec Testing Maturity work programin this role willimplement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. The role will support secure CI/CD integration, application onboarding, vulnerability management, security standards and reporting, software supply chain risk management, and secure SDLC practices, while collaborating with technical teams and providing knowledge transfer to internal staff.

Responsibilities

• Application Security & DevSecOps Implementation
• GitHub & Platform Security Integration: Implement and optimize application security capabilities across GitHub Enterprise and GitHub Advanced Security (GHAS) in a production enterprise environment.
• Pipeline & Testing Automation: Integrate automated security testing controls—including CodeQL, SAST, SCA, secret scanning, dependency review, and Infrastructure as Code (IaC) scanning—into GitHub Actions and Azure DevOps pull request, build, and release workflows.
• Application Onboarding & Supply Chain Security: Lead application security onboarding, software supply chain risk management, vulnerability management, and risk-based remediation workflows.
• Standards, Metrics & Governance: Design and maintain repeatable application security standards, threat modeling frameworks, secure SDLC governance, operating procedures, and reporting metrics using OWASP frameworks.
• Knowledge Transfer & Coaching: Coach internal resources, guide technical teams, and complete effective knowledge transfer to build long-term internal capability.
• Enterprise Risk Mitigation & Security Operations
• Risk & Incident Management: Identify potential cyber security risks and incidents by performing vulnerability assessments, monitoring security logs/external events, and analyzing security test results.
• Incident Response Support: Provide support during and after critical system breaches, outages, or anomalies by drafting security operations documents (e.g., incident reports) and collaborating with incident response leads.
• Project Security Guidance: Conduct compliance impact assessments and advise project managers to ensure IT projects apply cybersecurity best practices and adhere to baseline security configurations (OS, networking, telecommunications).
• Compliance & Sustainment Activities: Collaborate with NERC CIP Policy SMEs, safety teams, emergency management teams, and security administrators to prepare audit supporting documentation and sustain CIP compliance policies and processes.
• Continuous Improvement: Tune threat detection analytics and review existing security controls and event data to continuously enhance overall security posture.

Qualifications

• Minimum 7 years of relevant experience in Information Technology / Software Engineering with at least 5 years dedicated to Cyber Security or equivalent.
• Minimum 3 years of hands-on DevSecOps or Application Security Engineering experience in a production or large enterprise environment.
• Must-Have Competencies
• Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security.
• Direct experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
• Hands-on experience integrating security controls into GitHub Actions and Azure DevOps pipelines.
• Automation/software development background with the ability to review and troubleshoot code, scripts, pipeline definitions, YAML workflows, and Infrastructure as Code security scanning.
• Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, NERC CIP, ISO 27001/2, NIST, and BC FIPPA regulations.
• Able to obtain and maintain a Security Clearance for a Security Sensitive Position
• Excellent written and spoken communication skills for a professional enterprise environment.
• Nice-to-Have Skills
• Hands-on experience with Infrastructure as Code technologies such as Terraform, Bicep, or ARM templates.
• Experience with SIEM platforms, WAF/NGFW, IAM/PKI solutions, and Database Activity Monitoring (DAM).
• Education and Certifications
• University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.
• Preferred Certifications
• Application & Cloud Security: GitHub Advanced Security (GH-500), GIAC Cloud Security Automation (GCSA), GIAC Cloud Security Essentials (GCLD), GIAC Public Cloud Security (GPCS).
• Microsoft Azure / DevOps: Microsoft Certified: DevOps Engineer Expert (AZ-400), Microsoft Certified: Azure Security Engineer Associate (AZ-500).
• Cybersecurity & Audit: CISSP, CRISC, CISA, CISM, GCIH, or GPEN.

Looking for meaningful work? We can help!

Raise is an established hiring firm with over 65 years of experience. We believe strongly in making the world a better place through work, which is why we’re a certified B Corporation and donate 10% of our profits to charity.

We strive to build teams that reflect the diversity of the communities we work in. We encourage all qualified applicants to apply, including people from traditionally underrepresented groups such as women, visible minorities, Indigenous peoples, people identifying as LGBTQ2SI, veterans, and people with visible/nonvisible disabilities.

We have a dedicated webpage for accommodations where you can learn more about what we offer and request accommodation: https://raise.jobs/accommodations/