Application Security Engineer

Hydrogen Group; Sydney; On-site; AUD 120,000 - 160,000; Full time

Job summary

Hydrogen Group is seeking an Application Security Engineer to join the Software Engineering group in Sydney. You will build on an existing engineering practice and drive risk-based remediation across data, investment and digital teams.

You will prioritise findings, provide actionable guidance to engineering teams, and own secure SDLC controls from design to maintenance. You will oversee GitHub security and drive evidence-based closure of vulnerabilities.

Qualifications

• Strong analytical skills and a track record of triaging and prioritising application security findings.
• Experience with SAST, DAST, SCA, secrets, API, container and infrastructure-as-code scanning, plus OWASP Top 10, API Security Top 10, common CWEs and software supply-chain risks.
• Experience defining, implementing and assessing secure SDLC controls across the full lifecycle.
• The ability to turn technical findings into clear, actionable guidance for engineering teams.
• Experience with vulnerability management workflows, ticketing, backlog management, reporting and evidence-based closure.
• Deep GitHub security knowledge, including repository governance, access models, branch protection, pull-request controls, code ownership, GitHub’s security features and application security integrations.
• Strong stakeholder engagement, written communication and follow-through.

Responsibilities

• Review results from application security tools (SAST, DAST, SCA etc.) and confirm genuine impact; filter false positives.
• Rank findings by severity, exploitability, asset exposure and business context; align with vulnerability management.
• Provide engineers clear, practical fix guidance and maintain traceability from finding to remediation ticket.
• Own secure SDLC controls from design through maintenance, including requirements, guidance, evidence and reviews.
• Oversee GitHub security: repository baselines, access reviews, branch protection, PR rules, code ownership, secrets protection and related integrations.
• Report on remediation backlog health and trends; escalate overdue items; manage risk exemptions from approval to expiry.

Skills

Analytical skills

SAST

DAST

SCA

IaC scanning

Secure SDLC

GitHub security

Stakeholder mgmt

Written comms

Backlog mgmt

Tools

GitHub

CI/CD tooling

Security tooling

Job description

We're looking for an Application Security Engineer to join the Software Engineering group at our financial services client in Sydney. Your job is to build on an already developed engineering practice and then begin to look at data, investment and digital engineering teams. You’ll make sure security findings are prioritised by real risk, fixed, and tracked until the fix is verified.

What you’ll be doing

• Reviewing results from application security tools covering SAST, DAST, SCA, secrets, API, container and infrastructure-as-code scanning, confirming genuine impact and weeding out false positives, duplicates and recurring root causes
• Ranking findings by severity, exploitability, how critical and exposed the asset is, and the business context, in line with the vulnerability management process
• Giving engineers clear, practical fix guidance, and keeping a traceable record from each finding to its remediation ticket, owner, due date, exception and closure evidence
• Owning secure SDLC controls from design through to ongoing maintenance, including the control requirements, implementation guidance, evidence expectations and reviews of whether the controls work
• Overseeing GitHub security and related integrations: repository baselines, access reviews, branch protection, pull-request rules, code ownership, secrets protection, scanning, status checks, ticketing and exception handling
• Reporting on the health, risk and trends of the remediation backlog, escalating overdue or blocked items, verifying completed fixes, keeping security records up to date, and managing risk exemptions from approval through to review or expiry

What you’ll bring

• Strong analytical skills and a track record of triaging and prioritising application security findings
• Working knowledge of SAST, DAST, SCA, secrets, API, container and infrastructure-as-code scanning, plus OWASP Top 10, API Security Top 10, common CWEs and software supply-chain risks
• Experience defining, implementing and assessing secure SDLC controls across the full lifecycle
• The ability to turn technical findings into clear, actionable guidance for engineering teams
• Experience with vulnerability management workflows, ticketing, backlog management, reporting and evidence-based closure
• Deep GitHub security knowledge, including repository governance, access models, branch protection, pull-request controls, code ownership, GitHub’s security features and application security integrations
• Strong stakeholder engagement, written communication and follow-through