Senior DevSecOps and Application Security SME
Duration: 10 to 12 months
What you'll do
- Provide hands-on DevSecOps and application security expertise for the AppSec Testing Maturity work program.
- Configure and optimize GitHub Enterprise and GitHub Advanced Security (GHAS), including CodeQL, code scanning, secret scanning, dependency review, repository rulesets, dashboards, and reporting.
- Implement and tune static application security testing (SAST), software composition analysis (SCA), secret scanning, and Infrastructure as Code (IaC) scanning for in-scope repositories and technology stacks.
- Integrate security testing into GitHub Actions, Azure DevOps pipelines, pull request workflows, build processes, release gates, and other automated delivery workflows where appropriate.
- Create reusable pipeline templates, security configurations, and onboarding patterns that application teams can adopt consistently.
- Work with application owners and developers to pilot the controls, validate developer workflows, resolve implementation issues, and support application onboarding.
- Define practical processes for vulnerability intake, triage, ownership, prioritization, remediation, exception handling, escalation, verification, and closure.
- Configure reporting that shows security-testing coverage, open findings, ownership, severity, aging, remediation status, and exceptions.
- Develop application security standards, minimum configuration requirements, implementation guidance, operating procedures, and support documentation.
- Assess software supply chain risks involving open-source dependencies, third-party GitHub Actions, build components, and developer tooling.
- Provide technical guidance on secure SDLC, DevSecOps, threat modeling, secure coding, and application security risk management.
- Collaborate with Cybersecurity, Platform, Applications, Cloud and Infrastructure teams, architecture, change management, application teams, vendors, and the Work Program Manager.
- Coach BC Hydro staff and deliver structured knowledge transfer so internal teams can operate and extend the capability after the contract ends.
- Provide clear progress updates, document risks and decisions, and contribute to work program deliverables and acceptance evidence.
What you bring
- University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.
- A minimum of 7 years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related work.
- A minimum of 3 years of hands-on DevSecOps or application security engineering experience.
- Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.
- Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
- Hands-on experience integrating security controls with GitHub Actions and Azure DevOps pipelines.
- Experience implementing security checks in pull request, build, and release workflows while balancing security requirements with developer usability.
- Experience with Infrastructure as Code and related security scanning. Experience with Terraform, Bicep, ARM templates, or similar technologies is preferred.
- A software development or automation background, with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
- Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
- Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.
- Proven ability to work with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders.
- Clear written and verbal communication skills, including the ability to explain technical risks and decisions to both technical and non-technical audiences.
- Demonstrated ability to coach internal resources and complete effective knowledge transfer.
- Preferred certifications include:
- GIAC Cloud Security Automation (GCSA)
- GIAC Cloud Security Essentials (GCLD)
- GIAC Public Cloud Security (GPCS)
- GitHub Advanced Security (GH-500)
- Microsoft Certified: DevOps Engineer Expert (AZ-400)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)