Note: The job is a remote job and is open to candidates in USA. Black Duck provides application security solutions that help organizations identify and remediate vulnerabilities across proprietary code, open source components, and application behavior. The Lead Strategic Services Consultant will lead client engagements involving DevSecOps and CI/CD operations, application security program assessments, framework alignment, and strategic roadmap development. The role also facilitates executive workshops, delivers recommendations, and contributes to internal tools and thought leadership.
Responsibilities
- Assist customers with application security testing (AST) tool configurations in their pipeline through creation of templates and confirmation of configurations
- Provide customers triage support for AST finding from their pipeline testing
- Lead AppSec Program maturity assessments using frameworks such as BSIMM and SSDF, including stakeholder interviews, evidence collection, and scoring
- Develop Strategic Roadmaps that define the client’s target state, 12–36-month roadmap, resource requirements, and success metrics
- Facilitate workshops with executive, engineering, and AppSec leadership to prioritize initiatives and align to organizational risk and compliance goals
- Deliver strategic presentations and recommendations to CISOs, CTOs, and software leadership teams
- Contribute to internal frameworks, templates, and accelerators (e.g., AppSec Program Roadmap IP, maturity scoring tools, reporting dashboards)
- Contribute to thought leadership through press commentary, webinars, or conference presentations on secure software governance and maturity advancement
Skills
- • US Citizenship or GC with 3 years of US residency and ability to pass a background check
- • 5–8+ years of experience in application security, software assurance, or product security consulting
- • Application Security and Vulnerability Management skills
- • Gitlab CI/CD, Python, AWS, Grafana
- • Working knowledge of frameworks such as BSIMM, NIST SSDF or OWASP SAMM
- • Proven experience developing or executing maturity models, capability assessments, or multi-year roadmaps for AppSec, Product Security, or DevSecOps programs
- • Excellent client-facing communication, facilitation, and presentation skills
- • Ability to synthesize technical findings into executive-level narratives and actionable plans
- • Prior consulting experience with a Big Four, boutique AppSec consultancy, or internal software security governance team
- • Experience in software supply chain risk management (SSCRM), AI/ML assurance, or DevSecOps pipeline design
- • Experience developing software and functioning within secure development lifecycles (SDLCs)
- • Industry certifications such as CEH, CISSP
Company Overview
Company H1B Sponsorship