Business Analyst – Application Security (SAST/SCA)
- XPT SoftwareAustralia PTY Ltd, incorporated in 2016, is a Software Services company
- XPT works with topclients across Australia in Banking, Insurance, Telecom,Retail, Energy, Mining and Manufacturingdomains.
- We have 120+technocrats in Australia working at our clientlocations.
- XPT SoftwareAustralia is part of group companies which has globalpresence across India & Europe.
- We have served100+ clients globally, fulfilling their onsite-offshoreneeds.
Act as the bridge between thecybersecurity team, engineering/DevOps teams, and the SME/AI Expert on thisinitiative, translating the business need (“introduce SAST and SCA acrossGitLab SaaS and GitLab On-Prem”) into a structured requirements, rollout, andgovernance framework. This requires enough working knowledge of AppSec scanningconcepts and GitLab's CI/CD model to write requirements an engineer or vendorcan act on without a long clarification loop.
Key Responsibilities
- Run discovery across engineering, platform, andsecurity stakeholders to map current-state SDLC, GitLab topology (SaaSgroups/projects vs. Self-Managed instances), CI/CD pipeline patterns, andexisting scanning tools (if any) across the telco's project portfolio.
- Document functional and non-functional requirementsfor SAST and SCA (dependency scanning) coverage — language/framework coverage,false-positive tolerance, scan performance/pipeline latency impact, and whethersecrets/container scanning are in scope.
- Produce a build-vs-buy / tool-selection matrixcomparing GitLab-native SAST/SCA (Free/Premium/Ultimate tiering) againstthird-party SAST/SCA tools, and identify where GitLab On-Prem versionconstraints affect feature availability versus SaaS.
- Define the vulnerability management workflow: finding→ triage → issue → remediation MR → SLA tracking, and how this maps intoGitLab's vulnerability management dashboard versus existing ITSM/ticketingtools.
- Write user stories/acceptance criteria for pipelineintegration, exception/waiver processes, developer notification flows, andreporting/dashboards for CISO-level visibility.
- Own the RAID log, stakeholder RACI, and rolloutsequencing plan (pilot teams → phased fleet-wide rollout across SaaS andOn-Prem estates).
- Support change management: developer communication,training material coordination, and adoption metrics (scan coverage %, MTTR onfindings, false-positive rate trend).
- Liaise directly with the SME and AI Expert roles toensure requirements reflect real tool capability and constraints rather thanassumptions.
Experience Level
Mid-to-Senior, 6–10 yearstotal BA experience, with at least 2–3 years specifically in cybersecurity,DevSecOps, or platform engineering programmes. Telco or large regulated-enterpriseexperience is a strong plus given data governance and change-control overhead.
Requirements
Required Knowledge & Skills
- Working understanding of SAST vs. SCA vs. DAST vs.secrets detection — what each catches and doesn't.
- Familiarity with GitLab CI/CD concepts (pipelines,merge requests, .gitlab-ci.yml) — doesn't need to write pipeline code, but mustread and reason about one.
- Understanding of GitLab licensing tiers(Free/Premium/Ultimate) and how SAST/SCA feature availability differs acrossthem.
- Vulnerability management lifecycle and commonframeworks (CVSS scoring, CWE, OWASP Top 10) at working-fluency level, notexpert depth.
- Experience writing requirements/user stories fortooling or platform rollouts (not just business-process BA work).
- Strong stakeholder facilitation skills — thisprogramme spans security, engineering, and platform teams who often havecompeting priorities.
- Comfortable working with technical SMEs to validatefeasibility rather than dictating requirements in isolation.
#J-18808-Ljbffr
Business Analyst – Application Security (SAST/SCA) in Melbourne employer: XPT Software
XPT Software is an exceptional employer, offering a dynamic work culture that fosters innovation and collaboration in the field of AI governance. Located at the heart of Defence operations, employees benefit from unique opportunities to engage with industry leaders and contribute to meaningful projects that enhance national security. With a strong focus on professional development, XPT Software supports employee growth through continuous learning and mentorship, making it an ideal place for those looking to make a significant impact in their careers.
