Senior DevSecOps and Application Security SME to implement and optimize application security capabilities GitHub Job Ottawa area,Ontario

Position: Senior DevSecOps and Application Security SME to implement and optimize application security capabilities across GitHub

Our client is looking for Senior Dev Sec Ops and Application Security SME to implement and optimize application security capabilities across Git Hub Enterprise, Git Hub Advanced Security, Git Hub Actions, and Azure Dev Ops, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning.

-

1 year contract, likley will extend, Open to remote, preferrrabley some local

** Please note that for the successful candidate will be required to provide and use their own laptop for the duration of the contract.

Senior Dev Sec Ops and Application Security SME supporting the App Sec Testing Maturity work program. The resource will implement and optimize application security capabilities across Git Hub Enterprise, Git Hub Advanced Security, Git Hub Actions, and Azure Dev Ops, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. The role will support secure CI/CD integration, application onboarding, vulnerability management, security standards and reporting, software supply chain risk management, and secure SDLC practices, while collaborating with technical teams and providing knowledge transfer to internal staff.

The anticipated assignment duration is 8 to 10 months, with the possibility of extension.

Must Have

University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.

A minimum of 7 years of relevant experience in software engineering, Dev Sec Ops , application security, cloud security, or closely related work, including a minimum of 3 years of hands-on Dev Sec Ops or application security engineering experience
.

Demonstrated hands-on experience implementing G
itHub Enterprise and Git Hub Advanced Security in a production or large enterprise environment.

Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.

Hands-on experience integrating security controls with Git Hub Actions and Azure Dev Ops pipelines, including security checks in pull request, build, and release workflows.

Experience with Infrastructure as Code and related security scanning.

A software development or automation background with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.

Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.

Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.

Proven ability to collaborate with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders, and communicate technical risks and decisions to technical and non-technical audiences.

Demonstrated ability to coach internal resources and complete effective knowledge transfer.

Nice to Have

Experience with Terraform, Bicep, ARM templates, or similar Infrastructure as Code technologies.

Preferred certifications include GIAC Cloud Security Automation (GCSA), GIAC Cloud Security Essentials (GCLD), GIAC Public Cloud Security (GPCS), Git Hub Advanced Security (GH-), Microsoft Certified:
Dev Ops Engineer Expert (AZ-), and Microsoft Certified:
Azure Security Engineer Associate (AZ-).