Impress employers and recruiters.
Choose from hundreds of resume examples.
Impress employers and recruiters.
Choose from hundreds of resume examples.
Tailor your resume to this Business Analyst – Application Security (SAST/SCA) role.
Rezi rewrites your resume against XPT Software Australia Pty Ltd's job description. Free.
Tailor your resume to this Business Analyst – Application Security (SAST/SCA) role.
Rezi rewrites your resume against XPT Software Australia Pty Ltd's job description. Free.
Don't guess if your resume is good enough.
See how it scores against the Business Analyst – Application Security (SAST/SCA) posting at XPT Software Australia Pty Ltd — free, in seconds.
Don't guess if your resume is good enough.
See how it scores against the Business Analyst – Application Security (SAST/SCA) posting at XPT Software Australia Pty Ltd — free, in seconds.
About the Role
Act as the bridge between cybersecurity, engineering/DevOps, and AI Expert teams to translate business needs into a structured requirements, rollout, and governance framework for introducing SAST and SCA across GitLab SaaS and On-Prem. Requires working knowledge of AppSec scanning concepts and GitLab's CI/CD model to write actionable requirements.
Responsibilities
- Run discovery across stakeholders to map current-state SDLC, GitLab topology, CI/CD pipeline patterns, and existing scanning tools.
- Document functional and non-functional requirements for SAST and SCA coverage, including language/framework coverage, false-positive tolerance, scan performance impact, and scope of secrets/container scanning.
- Produce a build-vs-buy / tool-selection matrix comparing GitLab-native SAST/SCA against third-party tools, considering GitLab On-Prem version constraints.
- Define the vulnerability management workflow from finding to remediation and its mapping into GitLab's dashboard versus existing ITSM/ticketing tools.
- Write user stories/acceptance criteria for pipeline integration, exception/waiver processes, developer notification flows, and reporting/dashboards.
- Own the RAID log, stakeholder RACI, and rollout sequencing plan.
- Support change management, including developer communication, training material coordination, and adoption metrics.
- Liaise with SME and AI Expert roles to ensure requirements reflect actual tool capability and constraints.
Requirements
- Working understanding of SAST vs. SCA vs. DAST vs. secrets detection.
- Familiarity with GitLab CI/CD concepts (pipelines, merge requests, .gitlab-ci.yml) to read and reason about them.
- Understanding of GitLab licensing tiers and feature availability differences.
- Working fluency in vulnerability management lifecycle and common frameworks (CVSS scoring, CWE, OWASP Top 10).
- Experience writing requirements/user stories for tooling or platform rollouts.
- Strong stakeholder facilitation skills across security, engineering, and platform teams.
- Comfortable working with technical SMEs to validate feasibility.
Skills
- SAST
- SCA
- DAST
- Secrets Detection
- GitLab CI/CD
- Vulnerability Management
- CVSS Scoring
- CWE
- OWASP Top 10
- Stakeholder Facilitation
Experience Level
- Mid-to-Senior
- 6–10 years total BA experience
- 2–3 years specifically in cybersecurity, DevSecOps, or platform engineering programmes
- Telco or large regulated-enterprise experience is a strong plus