Senior DevSecOps and Application Security SME

Pay Rate: $82.81/hour, depending on experience

Contract: Start Date2026-12-14 End Date2027-12-11

Location: Vancouver, British Columbia

Raise is currently hiring a Senior DevSecOps and Application Security SME on behalf of our client. They’re expanding their team to meet growing needs, making this a unique opportunity to work with an industry leader. Our Client, is one of the largest electrical energy suppliers in Canada.

Note: The primary pay rate is based on T4 classification; however, we will also consider applications from candidates interested in an INC classification, where applicable.

Description

The Senior DevSecOps and Application Security SME supporting the AppSec Testing Maturity work programin this role willimplement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. The role will support secure CI/CD integration, application onboarding, vulnerability management, security standards and reporting, software supply chain risk management, and secure SDLC practices, while collaborating with technical teams and providing knowledge transfer to internal staff.

Responsibilities

- Application Security & DevSecOps Implementation
- GitHub & Platform Security Integration: Implement and optimize application security capabilities across GitHub Enterprise and GitHub Advanced Security (GHAS) in a production enterprise workplace.
- Pipeline & Testing Automation: Integrate automated security testing controls—including CodeQL, SAST, SCA, secret scanning, dependency review, and Infrastructure as Code (IaC)



scanning—into GitHub Actions and Azure DevOps pull request, build, and release workflows.
- Application Onboarding & Supply Chain Security: Lead application security onboarding, software supply chain risk management, vulnerability management, and risk-based remediation workflows.
- Standards, Metrics & Governance: Design and maintain repeatable application security standards, threat modeling frameworks, secure SDLC governance, operating procedures, and reporting metrics using OWASP frameworks.
- Knowledge Transfer & Coaching: Coach internal resources, guide technical teams, and complete effective knowledge transfer to build long-term internal capability.
- Enterprise Risk Mitigation & Security Operations
- Risk & Incident Management: Identify potential cyber security risks and incidents by performing vulnerability assessments, monitoring security logs/external events, and analyzing security test results.
- Incident Response Support: Provide support during and after critical system breaches, outages, or anomalies by drafting security operations documents (e.g., incident reports) and collaborating with incident response leads.
- Project Security Guidance: Conduct compliance impact assessments and advise project managers to ensure IT projects apply cybersecurity best practices and adhere to baseline security configurations (OS,



networking, telecommunications).
- Compliance & Sustainment Activities: Collaborate with NERC CIP Policy SMEs, safety teams, emergency management teams, and security administrators to prepare audit supporting documentation and sustain CIP compliance policies and processes.
- Continuous Improvement: Tune threat detection analytics and review existing security controls and event data to continuously enhance overall security posture.

Qualifications

- Minimum 7 years of relevant experience in Information Technology / Software Engineering with at least 5 years dedicated to Cyber Security or equivalent.
- Minimum 3 years of hands-on DevSecOps or Application Security Engineering experience in a production or large enterprise environment.
- Must-Have Competencies
- Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security.
- Direct experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
- Hands-on experience integrating security controls into GitHub Actions and Azure DevOps pipelines.
- Automation/software development background with the ability to review and troubleshoot code, scripts, pipeline definitions, YAML workflows, and Infrastructure as Code security scanning.
- Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, NERC CIP, ISO 27001/2, NIST, and BC FIPPA regulations.
- Able to obtain and maintain a Security Clearance for a Security Sensitive Position
- Excellent written and spoken communication skills for a professional enterprise environment.
- N

📌 Senior DevSecOps and Application Security SME (Vancouver)
🏢 Ian Martin Group
📍 Vancouver