IT Cyber Security Consultant -L3 (12 month contract)

Location: Burnaby, BC / Hybrid

Staffing Placement Prospect

General Description The IT Cybersecurity Consultant – Level 3 is responsible for strengthening application security and DevSecOps practices by identifying, assessing, mitigating, and documenting cybersecurity risks. The role focuses on improving application security testing maturity, implementing security controls throughout the software development lifecycle, and ensuring that applications, development pipelines, and cloud environments align with established security standards and best practices.

The consultant works closely with application development teams, cybersecurity specialists, DevOps engineers, platform owners, and other stakeholders to implement automated security testing, improve vulnerability management, establish repeatable security practices, and support the continuous improvement of application security capabilities.

Experience And Role Accountabilities

- Identify and assess application security risks and vulnerabilities through security testing, vulnerability assessments, code analysis, and collaboration with technical teams and stakeholders.
- Implement and maintain application security testing capabilities using GitHub Enterprise and GitHub Advanced Security, including CodeQL, static application security testing (SAST), software composition analysis (SCA), secret scanning, dependency review, and vulnerability remediation workflows.
- Integrate automated security controls into GitHub Actions and Azure DevOps pipelines, incorporating security checks into pull requests, builds, and release workflows.
- Analyze security findings, assess potential business and technical impacts, prioritize remediation based on risk, and recommend practical solutions to reduce exposure.
- Support the design, implementation, and continuous improvement of secure software development lifecycle (SDLC) practices, including application security testing, threat modeling, vulnerability management, and software supply chain security.
- Implement and support security scanning for Infrastructure as Code (IaC) and related development and deployment processes.
- Review and troubleshoot application code, scripts, pipeline definitions, and YAML-based workflows to identify security weaknesses and resolve technical issues.
- Develop and maintain application security standards, governance frameworks, operating procedures, testing requirements, and onboarding practices to promote consistent security implementation across development teams.
- Establish and maintain security metrics, reporting processes, and remediation tracking to measure application security coverage, identify gaps, and support continuous improvement.
- Collaborate with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders to define security requirements, evaluate technical options, and implement appropriate security controls.
- Provide technical guidance and coaching to development and DevOps teams on secure coding, security testing tools, vulnerability remediation, and DevSecOps best practices.
- Support the implementation and adoption of application security capabilities by coordinating knowledge transfer, documenting technical processes, and enabling internal teams to maintain and operate implemented solutions.
- Communicate security risks, assessment results, remediation recommendations, and implementation decisions clearly to both technical and non-technical audiences.

Education And Skills

- University or college degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field. An equivalent combination of education and relevant experience may be considered.
- Minimum of seven (7) years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related areas, including at least three (3) years of hands-on DevSecOps or application security engineering experience.
- Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.
- Strong technical experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
- Hands-on experience integrating security controls into GitHub Actions and Azure DevOps pipelines.
- Experience with Infrastructure as Code and associated security scanning tools and practices.
- Software development, scripting, or automation experience, with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
- Working knowledge of secure SDLC practices, OWASP application security principles, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
- Experience developing repeatable application security standards, governance practices, operating procedures, security metrics, and onboarding processes.
- Strong analytical, problem-solving, communication, and stakeholder management skills.
- Proven ability to collaborate across technical teams and communicate cybersecurity risks and recommendations effectively.
- Demonstrated ability to coach internal resources, facilitate knowledge transfer, and support the sustainable adoption of security practices.

Nice-to-Have Qualifications

- Experience with Infrastructure as Code technologies, including Terraform, Bicep, ARM templates, or similar tools.
- Relevant certifications, such as:
- GIAC Cloud Security Automation (GCSA)
- GIAC Cloud Security Essentials (GCLD)
- GIAC Public Cloud Security (GPCS)
- GitHub Advanced Security (GH-500)
- Microsoft Certified: DevOps Engineer Expert (AZ-400)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)

Terms and Conditions

- Contract resource supporting an Application Security Testing (AppSec) Maturity and Improvement Program.
- The consultant is expected to support the implementation, standardization, and continuous improvement of application security testing and DevSecOps capabilities, with an emphasis on automation, governance, vulnerability remediation, and knowledge transfer.

Note: this is an opportunity with a Microserve client.

📌 IT Cyber Security Consultant - (British Columbia)
🏢 Microserve
📍 British Columbia