Senior DevSecOps and Application Security SME to implement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret…

S.I. Systems Ltd.; United States; Remote; CAD 83,000 - 138,000; Full time

Benefits offered by this job

Remote work

Job summary

S.I. Systems Ltd. seeks a Senior DevSecOps and Application Security SME to implement and optimize security across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps.

You will drive SAST, SCA, secret scanning, CodeQL, dependency reviews, and IaC security within secure CI/CD pipelines. The role requires 7+ years in software engineering or security, hands-on GitHub/GitHub Advanced Security experience, and ability to coach teams.

Qualifications

• 7+ years in software engineering or security with hands-on DevSecOps or application security

Skills

DevSecOps

Application Security

GitHub Enterprise

GitHub Advanced Security

CodeQL

SAST

SCA

Secret scanning

IaC security

CI/CD security

Threat modelling

OWASP practices

Security governance

Knowledge transfer

Education

CS/IT related degree

Tools

GitHub Enterprise

GitHub Advanced Security

CodeQL

Terraform

Bicep

ARM templates

Azure DevOps

Job description

Senior DevSecOps and Application Security SME to implement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. - 7405

Job Type: Contract

Positions to fill: 1

Job End Date: Dec 11, 2027

Pay Rate: Hourly: Negotiable

Job ID: 155783

1 year contract, likley will extend, Open to remote, preferrrabley some local

Please note that for the successful candidate will be required to provide and use their own laptop for the duration of the contract.

Senior DevSecOps and Application Security SME supporting the AppSec Testing Maturity work program. The resource will implement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. The role will support secure CI/CD integration, application onboarding, vulnerability management, security standards and reporting, software supply chain risk management, and secure SDLC practices, while collaborating with technical teams and providing knowledge transfer to internal staff. The anticipated assignment duration is 8 to 10 months, with the possibility of extension.

Must Have

• University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.
• A minimum of 7 years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related work, including a minimum of 3 years of hands-on DevSecOps or application security engineering experience.
• Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.
• Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
• Hands-on experience integrating security controls with GitHub Actions and Azure DevOps pipelines, including security checks in pull request, build, and release workflows.
• Experience with Infrastructure as Code and related security scanning.
• A software development or automation background with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
• Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
• Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.
• Proven ability to collaborate with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders, and communicate technical risks and decisions to technical and non-technical audiences.
• Demonstrated ability to coach internal resources and complete effective knowledge transfer.

Nice to Have

• Experience with Terraform, Bicep, ARM templates, or similar Infrastructure as Code technologies.
• Preferred certifications include GIAC Cloud Security Automation (GCSA), GIAC Cloud Security Essentials (GCLD), GIAC Public Cloud Security (GPCS), GitHub Advanced Security (GH-500), Microsoft Certified: DevOps Engineer Expert (AZ-400), and Microsoft Certified: Azure Security Engineer Associate (AZ-500).