Role PurposeOwn the technical design, standards, and hands-ondelivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem.
Thisrole carries the full depth of an AppSec Specialist's skillset — secure SDLCdesign, vulnerability management discipline, architecture review, developerenablement — but applied narrowly and intensively to this one initiative forits duration, rather than as an ongoing cross-portfolio function.KeyResponsibilities• Assesscurrent SDLC and CI/CD pipeline architecture across both GitLab SaaS andSelf-Managed/On-Prem instances, including version currency on the On-Prem side.
• Stakeholdermanagement as there are different owners for Gitlab SaaS and Gitlab OnPrem• Definethe target-state SAST/SCA architecture: which GitLab-native features to use(Advanced SAST, dependency scanning, container/secrets scanning if in scope),where coverage gaps exist, and whether a third-party tool is required to closethem.
• Reviewpipeline and repo structure for security-relevant design issues (authN/authZpatterns, trust boundaries, dependency exposure) uncovered during rollout.
• Setscanning policy for the initiative: severity thresholds, blocking vs.non-blocking pipeline gates, exception/waiver criteria, and false-positivemanagement approach.
• Definesecure coding standards and guardrails scanning results should be measured against(e.g., OWASP ASVS, CWE Top 25), scoped to the languages/frameworks in thisrollout.
• Designthe vulnerability triage and remediation workflow, including SLAs by severity,and how findings map into existing ticketing/GRC tooling.
• Validatefeasibility of BA-authored requirements before they're finalized; providetechnical input into vendor evaluation/RFP if a third-party tool isshortlisted.
• Performroot-cause analysis on recurring finding patterns surfaced during pilotrollout, and adjust scanning configuration/rules accordingly.
• Providetechnical sign-off on rollout readiness per team/project before scanning gatesgo live.




• Runsecure coding and remediation training for engineering teams as scanning gatesgo live for their projects.
• Buildlightweight internal documentation/reference material so teams can self-servecommon remediation patterns after the SME's engagement ends.
• Documentarchitecture decisions, policy rationale, and configuration standards in a formthe client's ongoing security team can operate and extend after the fixed-termengagement concludes.ExperienceLevelSenior, 8–12+ years in application security / securesoftware engineering, with at least 4–5 years hands-on with SAST/SCA toolingspecifically, and prior experience in AppSec practice broadly enough to bringarchitecture review and developer-enablement skills, not just scannerconfiguration.RequiredKnowledge & Skills• Deepworking knowledge of SAST, SCA, DAST, and secrets detection — internals of howstatic analyzers work, not just tool operation.
• Hands-onexperience with GitLab's native security scanning (Advanced SAST, dependencyscanning) across both SaaS and Self-Managed, including feature parity gapsbetween tiers/versions.
• Practicalexperience with at least one major third-party SAST/SCA tool to informbuild-vs-buy decisions credibly.
• CI/CDpipeline engineering fluency — able to write/review .
gitlab-ci.yml and reasonabout pipeline performance impact.
• Stronggrasp of vulnerability scoring/prioritization (CVSS, EPSS, CWE) and experienceavoiding alert fatigue in high-volume scanning environments.
• Securedesign fundamentals — authN/authZ, threat modeling (e.g., STRIDE) — sufficientto review architecture surfaced during rollout.
• Strongcommunication skills for developer training and cross-team escalation handling.
• Telcoor critical-infrastructure security experience is a solid plus givenregulatory and change-control constraints.Nice to Have• Relevantcertifications: OSCP, GWAPT, CSSLP, or equivalent.
• Experiencerunning a phased SAST/SCA rollout across a large multi-team, multi-repo GitLabestate (100+ projects).
• Experiencestructuring handover documentation/runbooks for fixed-term securityengagements.

📌 Devsecops Specialist (New South Wales)
🏢 XPT Software Australia Pty
📍 New South Wales