Job Description

Job Description

1 year+ contract | Remote | No C2C

We are seeking an experienced Cyber Security Product Owner / Business Analyst to support the development, enhancement, and adoption of Application Security (AppSec) and Data Protection capabilities across the organization.

This individual will serve as a key liaison between business units, application development teams, Business Information Security Officers (BISOs), and Cyber Security teams. The role will focus on assessing existing security capabilities, identifying gaps, gathering business and technical requirements, and developing clear service offerings to improve security adoption across the organization.

The ideal candidate combines a strong understanding of application security and DevSecOps practices with experience in business analysis, product ownership, requirements gathering, and stakeholder management.

Key Responsibilities

1. Security Capability Assessment & Gap Analysis

• Assess the implementation and coverage of key security capabilities, including SAST, DAST, Container Security, PKI, and Secrets Management.
• Identify gaps in security coverage, integrations, processes, and existing capabilities across applications and business units.
• Conduct assessments to understand application security requirements and identify opportunities for improvement.
• Translate identified gaps into actionable business and technical requirements for AppSec teams.
• Maintain a requirements and gap register and track improvements through a prioritized backlog.

2. Service Catalog Development & Documentation

• Develop and maintain service offering catalogs for SAST, DAST, Container Security, PKI, and Secrets Management.
• Document service scope, onboarding procedures, prerequisites, responsibilities, support models, and integration requirements.
• Create clear documentation outlining available security services and how application teams can leverage them.
• Standardize service documentation to improve consistency, visibility, and adoption across business units.

3. Stakeholder Engagement & Cross-Functional Collaboration

• Serve as the primary liaison between business units, application teams, engineering, DevOps, architecture, BISOs, and Cyber Security.
• Communicate AppSec capabilities, program updates, security standards, and implementation requirements to application development teams.
• Lead discovery sessions to understand application environments, development processes, security requirements, and implementation challenges.
• Partner with engineering and development teams to align security capabilities with application architectures and CI/CD pipelines.
• Identify adoption challenges and collaborate with AppSec teams to address gaps in existing solutions.
• Influence stakeholders and drive adoption initiatives across teams without direct reporting authority.

4. Product Ownership & Requirements Management

• Gather, analyze, and document business and technical requirements related to application security services.
• Translate business needs and technical challenges into actionable requirements and improvement initiatives.
• Manage and prioritize product backlogs based on business needs, security priorities, and capability gaps.
• Collaborate with technical teams to evaluate existing solutions and recommend enhancements.
• Track initiatives, deliverables, and adoption progress while providing regular updates to stakeholders.

Required Qualifications & Experience

• Experience as a Product Owner, Product Manager, Technical Business Analyst, or Security Consultant within Cyber Security, Application Security, or DevSecOps.
• Strong understanding of application security capabilities, including:
• Static Application Security Testing (SAST).
• Dynamic Application Security Testing (DAST).
• Container Security.
• Public Key Infrastructure (PKI).
• Secrets Management.
• CI/CD security integration.
• Experience with security capability assessments, gap analysis, and requirements gathering.
• Background developing service catalogs, technical documentation, product backlogs, or service delivery frameworks.
• Understanding of application development environments, software development lifecycle (SDLC), and DevSecOps practices.
• Strong stakeholder management and communication skills, with the ability to work effectively across business and technical teams.
• Ability to translate complex technical concepts into clear business requirements and actionable recommendations.
• Demonstrated ability to influence stakeholders, coordinate cross-functional initiatives, and drive adoption without direct authority.

Key Deliverables

Throughout the engagement, the consultant will be responsible for producing:

• Security capability and coverage assessments across business units and applications.
• Service offering catalogs for key AppSec and Data Protection capabilities.
• Business unit and application security adoption assessments.
• Documented requirements and capability gap registers.
• Prioritized improvement backlogs.
• Application onboarding and adoption pipelines.
• Recommendations for addressing gaps in existing security solutions.
• Regular reporting on security adoption, coverage, documentation, and improvement initiatives.

Role Objective

Improve the adoption, visibility, and coverage of Application Security services by connecting business requirements with existing security capabilities, identifying areas for improvement, and partnering with technical teams to enhance security solutions across the organization.

Job Tags

Similar Jobs