General Description
\n\nThe IT Cybersecurity Consultant – Level 3 is responsible for strengthening application security and DevSecOps practices by identifying, assessing, mitigating, and documenting cybersecurity risks. The role focuses on improving application security testing maturity, implementing security controls throughout the software development lifecycle, and ensuring that applications, development pipelines, and cloud environments align with established security standards and best practices.
\n\nThe consultant works closely with application development teams, cybersecurity specialists, DevOps engineers, platform owners, and other stakeholders to implement automated security testing, improve vulnerability management, establish repeatable security practices, and support the continuous improvement of application security capabilities.
\n\nExperience and Role Accountabilities
\n\nIdentify and assess application security risks and vulnerabilities through security testing, vulnerability assessments, code analysis, and collaboration with technical teams and stakeholders.
\n\t\n\tImplement and maintain application security testing capabilities using GitHub Enterprise and GitHub Advanced Security, including CodeQL, static application security testing (SAST), software composition analysis (SCA), secret scanning, dependency review, and vulnerability remediation workflows.
\n\t\n\tIntegrate automated security controls into GitHub Actions and Azure DevOps pipelines, incorporating security checks into pull requests, builds, and release workflows.
\n\t\n\tAnalyze security findings, assess potential business and technical impacts, prioritize remediation based on risk, and recommend practical solutions to reduce exposure.
\n\t\n\tSupport the design, implementation, and continuous improvement of secure software development lifecycle (SDLC) practices, including application security testing, threat modeling, vulnerability management, and software supply chain security.
\n\t\n\tImplement and support security scanning for Infrastructure as Code (IaC) and related development and deployment processes.
\n\t\n\tReview and troubleshoot application code, scripts, pipeline definitions, and YAML-based workflows to identify security weaknesses and resolve technical issues.
\n\t\n\tDevelop and maintain application security standards, governance frameworks, operating procedures, testing requirements, and onboarding practices to promote consistent security implementation across development teams.
\n\t\n\tEstablish and maintain security metrics, reporting processes, and remediation tracking to measure application security coverage, identify gaps, and support continuous improvement.
\n\t\n\tCollaborate with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders to define security requirements, evaluate technical options, and implement appropriate security controls.
\n\t\n\tProvide technical guidance and coaching to development and DevOps teams on secure coding, security testing tools, vulnerability remediation, and DevSecOps best practices.
\n\t\n\tSupport the implementation and adoption of application security capabilities by coordinating knowledge transfer, documenting technical processes, and enabling internal teams to maintain and operate implemented solutions.
\n\t\n\tCommunicate security risks, assessment results, remediation recommendations, and implementation decisions clearly to both technical and non-technical audiences.
\n\t\nEducation and Skills
\n\nUniversity or college degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field. An equivalent combination of education and relevant experience may be considered.
\n\t\n\tMinimum of seven (7) years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related areas, including at least three (3) years of hands-on DevSecOps or application security engineering experience.
\n\t\n\tDemonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.
\n\t\n\tStrong technical experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
\n\t\n\tHands-on experience integrating security controls into GitHub Actions and Azure DevOps pipelines.
\n\t\n\tExperience with Infrastructure as Code and associated security scanning tools and practices.
\n\t\n\tSoftware development, scripting, or automation experience, with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
\n\t\n\tWorking knowledge of secure SDLC practices, OWASP application security principles, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
\n\t\n\tExperience developing repeatable application security standards, governance practices, operating procedures, security metrics, and onboarding processes.
\n\t\n\tStrong analytical, problem-solving, communication, and stakeholder management skills.
\n\t\n\tProven ability to collaborate across technical teams and communicate cybersecurity risks and recommendations effectively.
\n\t\n\tDemonstrated ability to coach internal resources, facilitate knowledge transfer, and support the sustainable adoption of security practices.
\n\t\nNice-to-Have Qualifications
\n\nExperience with Infrastructure as Code technologies, including Terraform, Bicep, ARM templates, or similar tools.
\n\t\n\tRelevant certifications, such as:
\n\n\tGIAC Cloud Security Automation (GCSA)
\n\t\t\n\t\tGIAC Cloud Security Essentials (GCLD)
\n\t\t\n\t\tGIAC Public Cloud Security (GPCS)
\n\t\t\n\t\tGitHub Advanced Security (GH-500)
\n\t\t\n\t\tMicrosoft Certified: DevOps Engineer Expert (AZ-400)
\n\t\t\n\t\tMicrosoft Certified: Azure Security Engineer Associate (AZ-500)
\n\t\t\n\tTerms and Conditions
\n\nContract resource supporting an Application Security Testing (AppSec) Maturity and Improvement Program.
\n\t\n\tThe consultant is expected to support the implementation, standardization, and continuous improvement of application security testing and DevSecOps capabilities, with an emphasis on automation, governance, vulnerability remediation, and knowledge transfer.
\n\t\n