Job Description

We are seeking a hands-on DevScope SME / Senior DevSecOps Engineer to drive the end-to-end design, implementation, and roll-out of application security scanning standards across enterprise engineering pipelines.

This is not an operational or monitoring position—it is a delivery-focused engineering role for a specialist who has built, integrated, and deployed SAST, SCA, and DAST platforms from the ground up. You will take ownership of defining security scanning boundaries (Dev Scope), establishing quality gates, configuring scanning engines, and automating security controls directly within active CI/CD pipelines.

Key Responsibilities

- Platform Implementation & Roll-Out: Lead the end-to-end configuration, deployment, and integration of code scanning platforms (e.g., Checkmarx, SonarQube, Veracode, Snyk, Fortify, or OWASP ZAP) across enterprise repositories.

- SAST, SCA & DAST Governance: Establish baseline rulesets, policy standards,



and enforcement mechanisms for Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Energetic Application Security Testing (DAST).

- Pipeline Security Automation: Embed automated security testing stages, quality gates, and failure conditions seamlessly into modern CI/CD pipelines (e.g., GitLab CI, GitHub Actions, Azure DevOps, Jenkins).

- Dev Scope & Triage Strategy: Define the operational scope of security scanning, establish false-positive triage workflows, and optimize rulesets to minimize developer friction while maintaining high security coverage.

- Engineering Enablement: Work directly with software engineering squads to provide guided remediation, establish secure coding standards, and build developer-first security

📌 DevSecOps SME - Contract (Melbourne)
🏢 NCS Australia
📍 Melbourne