Senior Devsecops And Application Security Sme

Senior DevSecOps and Application Security SME
Duration: 10 to 12 monthsWhat you'll doProvide hands-on DevSecOps and application security expertise for the AppSec Testing Maturity work program.Configure and optimize GitHub Enterprise and GitHub Advanced Security (GHAS), including CodeQL, code scanning, secret scanning, dependency review, repository rulesets, dashboards, and reporting.Implement and tune static application security testing (SAST), software composition analysis (SCA), secret scanning, and Infrastructure as Code (IaC) scanning for in-scope repositories and technology stacks.Integrate security testing into GitHub Actions, Azure DevOps pipelines, pull request workflows, build processes, release gates, and other automated delivery workflows where appropriate.Create reusable pipeline templates, security configurations, and onboarding patterns that application teams can adopt consistently.Work with application owners and developers to pilot the controls, validate developer workflows, resolve implementation issues, and support application onboarding.Define practical processes for vulnerability intake, triage, ownership, prioritization, remediation, exception handling, escalation, verification, and closure.Configure reporting that shows security-testing coverage, open findings, ownership, severity, aging, remediation status, and exceptions.Develop application security standards, minimum configuration requirements, implementation guidance, operating procedures, and support documentation.Assess software supply chain risks involving open-source dependencies, third-party GitHub Actions, build components, and developer tooling.Provide technical guidance on secure SDLC, DevSecOps, threat modeling, secure coding, and application security risk management.Collaborate with Cybersecurity, Platform, Applications, Cloud and Infrastructure teams, architecture, change management, application teams, vendors, and the Work Program Manager.Coach BC Hydro staff and deliver structured knowledge transfer so internal teams can operate and extend the capability after the contract ends.Provide clear progress updates, document risks and decisions, and contribute to work program deliverables and acceptance evidence.What you bringUniversity or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field;
an equivalent combination of education and relevant experience may be considered.A minimum of 7 years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related work.A minimum of 3 years of hands-on DevSecOps or application security engineering experience.Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.Hands-on experience integrating security controls with GitHub Actions and Azure DevOps pipelines.Experience implementing security checks in pull request, build, and release workflows while balancing security requirements with developer usability.Experience with Infrastructure as Code and related security scanning. Experience with Terraform, Bicep, ARM templates, or similar technologies is preferred.A software development or automation background, with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.Proven ability to work with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders.Clear written and verbal communication skills, including the ability to explain technical risks and decisions to both technical and non-technical audiences.Demonstrated ability to coach internal resources and complete effective knowledge transfer.Preferred certifications include:GIAC Cloud Security Automation (GCSA)GIAC Cloud Security Essentials (GCLD)GIAC Public Cloud Security (GPCS)GitHub Advanced Security (GH-500)Microsoft Certified: Azure Security Engineer Associate (AZ-500)
#J-18808-Ljbffr