Senior Dev SecOps and Application Security SME

Duration: 10 to 12 months

What you'll do

- Provide hands-on Dev SecOps and application security expertise for the App Sec Testing Maturity work program.
- Configure and optimize Git Hub Enterprise and Git Hub Advanced Security (GHAS), including CodeQL, code scanning, secret scanning, dependency review, repository rulesets, dashboards, and reporting.
- Implement and tune static application security testing (SAST), software composition analysis (SCA), secret scanning, and Infrastructure as Code (IaC) scanning for in-scope repositories and technology stacks.
- Integrate security testing into Git Hub Actions, Azure Dev Ops pipelines, pull request workflows, build processes, release gates, and other automated delivery workflows where appropriate.
- Create reusable pipeline templates, security configurations, and onboarding patterns that application teams can adopt consistently.
- Work with application owners and developers to pilot the controls, validate developer workflows, resolve implementation issues, and support application onboarding.
- Define practical processes for vulnerability intake, triage, ownership, prioritization, remediation, exception handling, escalation, verification, and closure.
- Configure reporting that shows security-testing coverage, open findings, ownership, severity, aging, remediation status, and exceptions.
- Develop application security standards, minimum configuration requirements, implementation guidance, operating procedures, and support documentation.
- Assess software supply chain risks involving open-source dependencies, third-party Git Hub Actions, build components, and developer tooling.




- Provide technical guidance on secure SDLC, Dev SecOps, threat modeling, secure coding, and application security risk management.
- Collaborate with Cybersecurity, Platform, Applications, Cloud and Infrastructure teams, architecture, change management, application teams, vendors, and the Work Program Manager.
- Coach BC Hydro staff and deliver structured knowledge transfer so internal teams can operate and extend the capability after the contract ends.
- Provide explicit progress updates, document risks and decisions, and contribute to work program deliverables and acceptance evidence.

What you bring

- University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.
- A minimum of 7 years of relevant experience in software engineering, Dev SecOps, application security, cloud security, or closely related work.
- A minimum of 3 years of hands-on Dev SecOps or application security engineering experience.
- Demonstrated hands-on experience implementing Git Hub Enterprise and Git Hub Advanced Security in a production or large enterprise environment.
- Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review,



and vulnerability remediation workflows.
- Hands-on experience integrating security controls with Git Hub Actions and Azure Dev Ops pipelines.
- Experience implementing security checks in pull request, build, and release workflows while balancing security requirements with developer usability.
- Experience with Infrastructure as Code and related security scanning. Experience with Terraform, Bicep, ARM templates, or similar technologies is preferred.
- A software development or automation background, with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
- Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
- Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.
- Proven ability to work with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders.
- Clear written and verbal communication skills, including the ability to explain technical risks and decisions to both technical and non-technical audiences.
- Demonstrated ability to coach internal resources and complete effective knowledge transfer.
- Preferred certifications include:
- GIAC Cloud Security Automation (GCSA)
- GIAC Cloud Security Essentials (GCLD)
- GIAC Public Cloud Security (GPCS)
- Git Hub Advanced Security (GH-500)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)

#J-18808-Ljbffr

📌 Senior DevSecOps and Application Security SME (Regina)
🏢 ThirdEye CyberSecurity
📍 Regina