Our client is looking for Senior DevSecOps and Application Security SME to implement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. -
1 year contract, likley will extend, Open to remote, preferrrabley some local
**Please note that for the successful candidate will be required to provide and use their own laptop for the duration of the contract.
Senior DevSecOps and Application Security SME supporting the AppSec Testing Maturity work program. The resource will implement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. The role will support secure CI/CD integration, application onboarding, vulnerability management, security standards and reporting, software supply chain risk management, and secure SDLC practices, while collaborating with technical teams and providing knowledge transfer to internal staff. The anticipated assignment duration is 8 to 10 months, with the possibility of extension.
Must Have
- University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.
- A minimum of 7 years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related work, including a minimum of 3 years of hands-on DevSecOps or application security engineering experience.
- Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.
- Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
- Hands-on experience integrating security controls with GitHub Actions and Azure DevOps pipelines, including security checks in pull request, build, and release workflows.
- Experience with Infrastructure as Code and related security scanning.
- A software development or automation background with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
- Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
- Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.
- Proven ability to collaborate with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders, and communicate technical risks and decisions to technical and non-technical audiences.
- Demonstrated ability to coach internal resources and complete effective knowledge transfer.
Nice to Have
- Experience with Terraform, Bicep, ARM templates, or similar Infrastructure as Code technologies.
- Preferred certifications include GIAC Cloud Security Automation (GCSA), GIAC Cloud Security Essentials (GCLD), GIAC Public Cloud Security (GPCS), GitHub Advanced Security (GH-), Microsoft Certified: DevOps Engineer Expert (AZ-), and Microsoft Certified: Azure Security Engineer Associate (AZ-).
