Black Duck Software, Inc. helps organizations build secure, high-quality software, minimizing risks while maximizing speed and productivity. Black Duck, a recognized pioneer in application security, provides SAST, SCA, and DAST solutions that enable teams to quickly find and fix vulnerabilities and defects in proprietary code, open source components, and application behavior. With a combination of industry-leading tools, services, and expertise, only Black Duck helps organizations maximize security and quality in DevSecOps and throughout the software development life cycle.
About the Role
We’re seeking a Lead Strategic Services Consultant with deep expertise in DevSecOps tooling, software security, processes, governance, maturity modeling, and framework-driven transformation planning. In this role, you’ll lead client engagements to assist in DevSecOps and CI/CD pipeline configuration and operations, assess Application Security Programs (AppSec Program) against established frameworks and design and deliver AppSec Program Strategic Roadmaps that help organizations build, scale, and measure their secure software development capabilities.
This position combines technical hands-on work with strategic consulting, framework alignment, and technical governance to translate assessment findings into actionable, measurable programs aligned to frameworks such as Building Security in Maturity Model (BSIMM) and NIST Secure Software Development Framework (SSDF).
Key Responsibilities
- Assist customers with application security testing (AST) tool configurations in their pipeline through creation of templates and confirmation of configurations.
- Provide customers triage support for AST finding from their pipeline testing.
- Lead AppSec Program maturity assessments using frameworks such as BSIMM and SSDF, including stakeholder interviews, evidence collection, and scoring.
- Develop Strategic Roadmaps that define the client’s target state, 12–36-month roadmap, resource requirements, and success metrics.
- Facilitate workshops with executive, engineering, and AppSec leadership to prioritize initiatives and align to organizational risk and compliance goals.
- Deliver strategic presentations and recommendations to CISOs, CTOs, and software leadership teams.
- Contribute to internal frameworks, templates, and accelerators (e.g., AppSec Program Roadmap IP, maturity scoring tools, reporting dashboards).
- Contribute to thought leadership through press commentary, webinars, or conference presentations on secure software governance and maturity advancement.
Qualifications Required:
- US Citizenship or GC with 3 years of US residency and ability to pass a background check.
- 5–8+ years of experience in application security, software assurance, or product security consulting.
- Application Security and Vulnerability Management skills
- Gitlab CI/CD, Python, AWS, Grafana
- Working knowledge of frameworks such as BSIMM, NIST SSDF or OWASP SAMM.
- Proven experience developing or executing maturity models, capability assessments, or multi-year roadmaps for AppSec, Product Security, or DevSecOps programs.
- Excellent client-facing communication, facilitation, and presentation skills.
- Ability to synthesize technical findings into executive-level narratives and actionable plans.
Preferred:
- Prior consulting experience with a Big Four, boutique AppSec consultancy, or internal software security governance team.
- Experience in software supply chain risk management (SSCRM), AI/ML assurance, or DevSecOps pipeline design.
- Experience developing software and functioning within secure development lifecycles (SDLCs)
- Industry certifications such as CEH, CISSP, CISM
What You’ll Deliver
- Hands on assistance with DevSecOps and CI/CD operations
- Comprehensive AppSec Program Roadmap plans and assessments against frameworks reports and presentations.
- Capability maturity and roadmap visuals.
- Executive-level engagement summaries and strategic recommendations.
Black Duck is an equal opportunity employer. We consider all applicants for employment without regard to race, color, national origin, religion, sex, gender identity or expression, age, disability, sexual orientation, veteran or military service status, or any other characteristic protected by applicable law. Black Duck complies with all applicable laws prohibiting employment discrimination in every jurisdiction where it operates and provides reasonable accommodations to individuals with disabilities in accordance with applicable law.
Skills Required
- US citizenship or green card with three years of US residency
- Ability to pass a background check
- 5–8+ years of experience in application security, software assurance, or product security consulting
- Application security and vulnerability management skills
- Experience with GitLab CI/CD, Python, AWS, and Grafana
- Working knowledge of BSIMM, NIST SSDF, or OWASP SAMM
- Experience developing or executing maturity models, capability assessments, or multi-year roadmaps for AppSec, Product Security, or DevSecOps programs
- Excellent client-facing communication, facilitation, and presentation skills
- Ability to synthesize technical findings into executive-level narratives and actionable plans
- Consulting experience with a Big Four firm, boutique application security consultancy, or internal software security governance team
- Experience in software supply chain risk management, AI/ML assurance, or DevSecOps pipeline design
- Experience developing software and functioning within secure development lifecycles
- CEH, CISSP, CISM, or similar industry certification
Black Duck Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Black Duck and has not been reviewed or approved by Black Duck.
-
Healthcare Strength — Medical, dental, and vision coverage provide multiple plan choices with transparent costs, with carrier updates noted for 2026. Vision via VSP and dental plan options offer defined tiers and network access.
-
Retirement Support — Retirement programs include a 401(k) with company matching alongside an employee stock purchase plan with a discount and lookback. These features support longer‑term savings and wealth building.
-
Leave & Time Off Breadth — Exempt employees use a manager‑approved, no‑cap time‑off model, while non‑exempt employees accrue flexible time off alongside sick time. Paid leaves include parental and family care leave, with additional protections under applicable leave laws.
Black Duck Insights
What We Do
Organizations worldwide use Black Duck Software’s industry-leading products to secure and manage open source software, eliminating the pain related to security vulnerabilities, compliance and operational risk. Black Duck is headquartered in Burlington, MA, and has offices in San Jose, London, Frankfurt, Hong Kong, Tokyo, Vancouver, Seoul & Beijing
Why Work With Us
We pride ourselves on cultivating an environment of collaboration, creativity, and fun! We know where you work can influence how you work, which is why our collaborative office space focuses on community and continuous learning. Our work-hard, play-hard attitude even got us named a Top Place to Work in Massachusetts by The Boston Globe!
Gallery
