Senior DevSecOps and Application Security SME

Senior DevSecOps and Application Security SME

Duration: 10 to 12 months

What you'll do

• Provide hands-on DevSecOps and application security expertise for the AppSec Testing Maturity work program. 
• Configure and optimize GitHub Enterprise and GitHub Advanced Security (GHAS), including CodeQL, code scanning, secret scanning, dependency review, repository rulesets, dashboards, and reporting. 
• Implement and tune static application security testing (SAST), software composition analysis (SCA), secret scanning, and Infrastructure as Code (IaC) scanning for in-scope repositories and technology stacks. 
• Integrate security testing into GitHub Actions, Azure DevOps pipelines, pull request workflows, build processes, release gates, and other automated delivery workflows where appropriate. 
• Create reusable pipeline templates, security configurations, and onboarding patterns that application teams can adopt consistently. 
• Work with application owners and developers to pilot the controls, validate developer workflows, resolve implementation issues, and support application onboarding. 
• Define practical processes for vulnerability intake, triage, ownership, prioritization, remediation, exception handling, escalation, verification, and closure. 
• Configure reporting that shows security-testing coverage, open findings, ownership, severity, aging, remediation status, and exceptions. 
• Develop application security standards, minimum configuration requirements, implementation guidance, operating procedures, and support documentation. 
• Assess software supply chain risks involving open-source dependencies, third-party GitHub Actions, build components, and developer tooling. 
• Provide technical guidance on secure SDLC, DevSecOps, threat modeling, secure coding, and application security risk management. 
• Collaborate with Cybersecurity, Platform, Applications, Cloud and Infrastructure teams, architecture, change management, application teams, vendors, and the Work Program Manager. 
• Coach BC Hydro staff and deliver structured knowledge transfer so internal teams can operate and extend the capability after the contract ends. 
• Provide clear progress updates, document risks and decisions, and contribute to work program deliverables and acceptance evidence. 

What you bring

• University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered. 
• A minimum of 7 years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related work. 
• A minimum of 3 years of hands-on DevSecOps or application security engineering experience. 
• Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment. 
• Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows. 
• Hands-on experience integrating security controls with GitHub Actions and Azure DevOps pipelines. 
• Experience implementing security checks in pull request, build, and release workflows while balancing security requirements with developer usability. 
• Experience with Infrastructure as Code and related security scanning. Experience with Terraform, Bicep, ARM templates, or similar technologies is preferred. 
• A software development or automation background, with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows. 
• Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation. 
• Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices. 
• Proven ability to work with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders. 
• Clear written and verbal communication skills, including the ability to explain technical risks and decisions to both technical and non-technical audiences. 
• Demonstrated ability to coach internal resources and complete effective knowledge transfer. 
• Preferred certifications include: 
• GIAC Cloud Security Automation (GCSA)  
• GIAC Cloud Security Essentials (GCLD) 
• GIAC Public Cloud Security (GPCS) 
• GitHub Advanced Security (GH-500) 
• Microsoft Certified: DevOps Engineer Expert (AZ-400) 
• Microsoft Certified: Azure Security Engineer Associate (AZ-500)