Application Security Analyst — Hybrid, 18‑Month FTC

Rest; Sydney; Hybrid; AUD 110,000 - 140,000; Full time

Benefits offered by this job

5 Rest Days

Parental leave (22 weeks)

AI & Data Academy

Income Protection Insurance

Professional memberships

Job summary

Rest, one of Australia’s largest profit-to-member super funds, is seeking an Application Security Analyst on an 18-month fixed‑term contract. You’ll strengthen security across applications, APIs and delivery pipelines, partnering with engineering, architecture and product teams to embed secure by design practices.

Based in Sydney or Melbourne, this hybrid role combines CBD office days with remote work, offering a real chance to impact security outcomes at scale while supporting Rest’s mission to

Qualifications

• Experience in application security, DevSecOps or secure software development in a complex enterprise.
• Experience conducting app security assessments across web apps, APIs and cloud-native environments.
• Strong knowledge of OWASP Top 10, secure coding, threat modelling and secure SDLC.
• Hands-on with app security tools: SAST, DAST, SCA, API testing and secrets detection.
• Knowledge of ASVS, SAMM, NIST CSF and APRA CPS 234.

Responsibilities

• Lead app security assessments across web apps, APIs and cloud services.
• Embed security into design through threat modelling and secure-by-design practices.
• Prioritise and manage findings with risk-based remediation guidance.
• Improve tooling: SAST/DAST/ SCA, API security testing and secrets detection.
• Promote secure SDLC and DevSecOps in CI/CD pipelines.

Skills

Application security

Threat modelling

DevSecOps

CI/CD security

Cloud AWS

Security tooling

Communication skills

Education

Bachelor's degree in CS/IT

Tools

SAST

DAST

SCA

API security testing

Secrets detection

Job description

Rest, one of Australia’s largest profit-to-member super funds, is seeking an Application Security Analyst on an 18-month fixed‑term contract. You’ll strengthen security across applications, APIs and delivery pipelines, partnering with engineering, architecture and product teams to embed secure by design practices.

Based in Sydney or Melbourne, this hybrid role combines CBD office days with remote work, offering a real chance to impact security outcomes at scale while supporting Rest’s mission to