The Role
Own the technical design and delivery of SAST/SCA capabilities across GitLab SaaS and Self-Managed environments. Assess CI/CD architecture, define scanning policies and secure coding standards, design vulnerability triage workflows, evaluate tooling, analyze recurring findings, approve rollout readiness, train developers, and document operational handoff. The role requires deep AppSec expertise, hands-on GitLab security scanning experience, secure software engineering knowledge, and strong stakeholder communication.
Summary Generated by Built In
Position: SME-App Security
Team: Cybersecurity — Application Security Engineering
Role Purpose
Own the technical design, standards, and hands-on delivery of SAST/SCA capability across GitLab SaaS and GitLab On-Prem. This role carries the full depth of an AppSec Specialist's skillset — secure SDLC design, vulnerability management discipline, architecture review, developer enablement — but applied narrowly and intensively to this one initiative for its duration, rather than as an ongoing cross-portfolio function.
Key Responsibilities
• Assess current SDLC and CI/CD pipeline architecture across both GitLab SaaS and Self-Managed/On-Prem instances, including version currency on the On-Prem side.
• Stakeholder management as there are different owners for Gitlab SaaS and Gitlab OnPrem
• Define the target-state SAST/SCA architecture: which GitLab-native features to use (Advanced SAST, dependency scanning, container/secrets scanning if in scope), where coverage gaps exist, and whether a third-party tool is required to close them.
• Review pipeline and repo structure for security-relevant design issues (authN/authZ patterns, trust boundaries, dependency exposure) uncovered during rollout.
• Set scanning policy for the initiative: severity thresholds, blocking vs. non-blocking pipeline gates, exception/waiver criteria, and false-positive management approach.
• Define secure coding standards and guardrails scanning results should be measured against (e.g., OWASP ASVS, CWE Top 25), scoped to the languages/frameworks in this rollout.
• Design the vulnerability triage and remediation workflow, including SLAs by severity, and how findings map into existing ticketing/GRC tooling.
• Validate feasibility of BA-authored requirements before they're finalized; provide technical input into vendor evaluation/RFP if a third-party tool is shortlisted.
• Perform root-cause analysis on recurring finding patterns surfaced during pilot rollout, and adjust scanning configuration/rules accordingly.
• Provide technical sign-off on rollout readiness per team/project before scanning gates go live.
• Run secure coding and remediation training for engineering teams as scanning gates go live for their projects.
• Build lightweight internal documentation/reference material so teams can self-serve common remediation patterns after the SME's engagement ends.
• Document architecture decisions, policy rationale, and configuration standards in a form the client's ongoing security team can operate and extend after the fixed-term engagement concludes.
Experience Level
Senior, 8+ years in application security / secure software engineering, with at least 4–5 years hands-on with SAST/SCA tooling specifically, and prior experience in AppSec practice broadly enough to bring architecture review and developer-enablement skills, not just scanner configuration.
Required Knowledge & Skills
• Deep working knowledge of SAST, SCA, DAST, and secrets detection — internals of how static analyzers work, not just tool operation.
• Hands-on experience with GitLab's native security scanning (Advanced SAST, dependency scanning) across both SaaS and Self-Managed, including feature parity gaps between tiers/versions.
• Practical experience with at least one major third-party SAST/SCA tool to inform build-vs-buy decisions credibly.
• CI/CD pipeline engineering fluency — able to write/review .gitlab-ci.yml and reason about pipeline performance impact.
• Strong grasp of vulnerability scoring/prioritization (CVSS, EPSS, CWE) and experience avoiding alert fatigue in high-volume scanning environments.
• Secure design fundamentals — authN/authZ, threat modeling (e.g., STRIDE) — sufficient to review architecture surfaced during rollout.
• Strong communication skills for developer training and cross-team escalation handling.
• Telco or critical-infrastructure security experience is a strong plus given regulatory and change-control constraints.
Nice to Have
• Relevant certifications: OSCP, GWAPT, CSSLP, or equivalent.
• Experience running a phased SAST/SCA rollout across a large multi-team, multi-repo GitLab estate (100+ projects).
• Experience structuring handover documentation/runbooks for fixed-term security engagements.
Skills Required
- 8+ years of experience in application security or secure software engineering
- 4–5 years of hands-on experience with SAST/SCA tooling
- Deep knowledge of SAST, SCA, DAST, and secrets detection, including static analyzer internals
- Hands-on experience with GitLab Advanced SAST and dependency scanning across SaaS and Self-Managed environments
- Experience with at least one major third-party SAST/SCA tool
- CI/CD pipeline engineering fluency, including writing or reviewing .gitlab-ci.yml
- Knowledge of CVSS, EPSS, CWE, vulnerability prioritization, and alert-fatigue reduction
- Secure design knowledge covering authentication, authorization, and threat modeling such as STRIDE
- Strong communication skills for developer training and cross-team escalation handling
- Telco or critical-infrastructure security experience
- OSCP, GWAPT, CSSLP, or equivalent certification
- Experience rolling out SAST/SCA across 100+ GitLab projects
- Experience creating handover documentation and runbooks for fixed-term security engagements
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
XPT Software Australia Pty Ltd is a technology consulting and software services company serving clients across banking, financial services and insurance, telecommunications, mining, retail, energy, and manufacturing. It provides software development, IT management consulting, business analysis, project and program management, infrastructure support, and offshore development through onsite-offshore delivery. The company also works with cloud computing, big data, mobile applications, UI/UX, algorithms, and IoT.
