Senior DevSecOps and Application Security SME

Job Description

Senior DevSecOps and Application Security SME

On behalf our client, Procom is seeking a consultant for an 12 month assignment- This is a hybrid role with 2 days in office per week in Vancouver, BC however 100% remote candidates will be considered across Canada.

Senior DevSecOps and Application Security SMEJob Details:

Senior DevSecOps and Application Security SME supporting the AppSec Testing Maturity work program. The resource will implement and optimize application security capabilities across GitHub Enterprise, GitHub Advanced Security, GitHub Actions, and Azure DevOps, including SAST, SCA, secret scanning, CodeQL, dependency review, and Infrastructure as Code scanning. The role will support secure CI/CD integration, application onboarding, vulnerability management, security standards and reporting, software supply chain risk management, and secure SDLC practices, while collaborating with technical teams and providing knowledge transfer to internal staff. The anticipated assignment duration is 8 to 10 months, with the possibility of extension.

Senior DevSecOps and Application Security SME Mandatory skills:

• University or College degree in Computer Science, Software Engineering, Information Technology, Cybersecurity, or a related field; an equivalent combination of education and relevant experience may be considered.
• A minimum of 7 years of relevant experience in software engineering, DevSecOps, application security, cloud security, or closely related work, including a minimum of 3 years of hands-on DevSecOps or application security engineering experience.
• Demonstrated hands-on experience implementing GitHub Enterprise and GitHub Advanced Security in a production or large enterprise environment.
• Strong experience with CodeQL, SAST, SCA, secret scanning, dependency review, and vulnerability remediation workflows.
• Hands-on experience integrating security controls with GitHub Actions and Azure DevOps pipelines, including security checks in pull request, build, and release workflows.
• Experience with Infrastructure as Code and related security scanning.
• A software development or automation background with the ability to review and troubleshoot code, scripts, pipeline definitions, and YAML-based workflows.
• Working knowledge of secure SDLC, OWASP application security practices, software supply chain security, threat modeling, vulnerability management, and risk-based remediation.
• Experience designing repeatable application security standards, governance, operating procedures, metrics, and onboarding practices.
• Proven ability to collaborate with application teams, cybersecurity teams, platform owners, vendors, contractors, and senior stakeholders, and communicate technical risks and decisions to technical and non-technical audiences.
• Demonstrated ability to coach internal resources and complete effective knowledge transfer.

Cyber Security Consultant Assignment Length:

12 month contract to start

Cyber Security Consultant Assignment Location:

This is a hybrid role with 2 days in office in Vancouver, BC.