Application Security Engineer (DevSecOps) – Cloud & CI/CD

Flybuys; Melbourne; On-site; AUD 120,000 - 180,000; Full time

Benefits offered by this job

Flybuysflex

Two well-being days per year

Volunteer leave

Learning & development programs

My Coles and Wesfarmers discount

Be Well Programs

Quarterly All Team events

Hybrid social events

New starter kit merchandise

Job summary

Flybuys is seeking a Security Engineer (Application Security) to embed security into how software is built, deployed and operated across the technology estate. You will partner with Engineering, Cloud and Data teams to deliver practical security outcomes from day one.

Join a Cyber Security team that supports engineering squads through vulnerability scanning, threat modelling, and security‑focused code reviews, while growing expertise in AI/ML‑assisted security workflows.

Qualifications

• 2-4 years in security engineering, DevSecOps, software engineering, or platform roles with security interest.
• Hands-on experience with CI/CD pipelines and integrating tools into automated delivery workflows.
• Working knowledge of AWS services and security basics.
• Experience with at least one security tool (SAST/DAST/SCA/IaC scanning, container image scanning, secrets detection).
• Understanding of OWASP Top 10 and common web app vulnerabilities.

Responsibilities

• Implement and maintain security scanning tools within GitLab CI/CD pipelines.
• Tune scanners to reduce false positives and improve developer feedback.
• Build quality gates for fast, actionable security feedback.
• Maintain security-as-code artefacts across repositories.
• Support engineering teams in remediating findings surfaced by tooling.
• Triage and prioritise vulnerability findings from CNAPP tools and cloud security services.
• Track remediation progress and support teams within SLA.
• Contribute to vulnerability reporting, dashboards, and metrics.

Skills

CI/CD integration

AWS basics

OWASP Top 10

SAST/DAST

Security automation

DevSecOps

Tools

GitLab

Container security

IaC scanning

Job description

About Us

We’re known for being the country’s most popular rewards program, helping over 10 million Australians get more of what they value beyond the checkout. And through our extended network of partnerships with other nationally recognised brands, we make every day simpler, easier and more rewarding for our members. Plus, we’re also the winner of Canstar Blue's 2023, 2024 and 2025 Most Satisfied Customer award for Rewards Programs 🥇🏆

But,we'remore than the card you carry around in your wallet or the app on your phone!Our diverse team islocatedall over Australia, and our incredible office islocatedright in the heart of Melbourne CBD.Staying true to our flexible working policy and people-centric culture, we ensure all our team members are set up to work remotely across Australia. We are outcomes-focused, and everything we do is aligned with our core principles - Own, Act and Inspire.

Your Team

We've already built a pretty amazing team, but we're not looking for more of the same. Our day-to-day is made stronger when we surround ourselves with people who are different, like you.

Your Role

The Security Engineer (Application Security) is a hands-on technical role that blends application security, DevSecOps, and cloud security. The role works alongside engineering teams to embed security into how software is built, deployed, and operated across Flybuys' technology estate. This role suits someone with a strong engineering foundation who is ready to grow deeper into application and cloud security, while contributing meaningfully from day one.

The role sits within the Cyber Security team and works closely with Application Development, Cloud, and Data teams. It is designed to be a practical, approachable security partner to engineering squads, supported by a senior security engineer and given room to learn, build, and grow.

Key Areas of Accountability

• Implement and maintain security scanning tools within GitLab CI/CD pipelines.
• Tune scanners to reduce false positives and improve the developer feedback experience.
• Help build quality gates that give developers fast, actionable security feedback without unnecessary friction.
• Maintain and extend security-as-code artefacts across repositories.
• Support engineering teams in understanding and remediating findings surfaced by pipeline tooling.
• Triage and prioritise vulnerability findings from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate findings with asset context, including internet exposure, data sensitivity, and business criticality.
• Track remediation progress and support engineering teams in fixing issues within SLA.
• Contribute to vulnerability reporting, dashboards, and metrics that help the team make better decisions.
• Identify patterns and recurring issues and recommend systemic fixes.
• Assist in implementing and maintaining security guardrails across AWS.
• Review Infrastructure-as-Code for security misconfigurations.
• Participate in threat modelling sessions and perform security-focused code reviews.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Build scripts, integrations, and lightweight tools to automate repetitive security tasks.
• Assist with AI/ML-assisted workflows and LLM-based tooling for security use cases

Your Experience

• 2-4 years in security engineering, DevSecOps, software engineering, or platform/infrastructure roles with demonstrated security interest.
• Hands-on experience with CI/CD pipelines, including configuring, troubleshooting, and integrating tools into automated delivery workflows.
• Working knowledge of AWS, including IAM basics, networking fundamentals, compute services, and native security services.
• Experience with at least one application security tool, such as SAST, DAST, SCA, IaC scanning, container image scanning, or secrets detection.
• Understanding of OWASP Top 10 and common web application vulnerabilities.
• Interest in and early experience with AI/ML tools or LLMs applied to engineering or security tasks.
• Good communication skills, with the ability to clearly explain findings and recommendations to developers.
• Experience with CNAPP platforms, GitLab, container security, or API security concepts (desirable)
• Exposure to threat modelling, AI/ML security risks, or secure use of LLM-based tooling (desirable)
• Relevant certifications or active pursuit of them (desirable)

Your Benefits!

We offer our valued team members a stack of exclusive benefits! To name a few...

• Flybuysflex | work from anywhere, measured on outcomes
• Two well-being days per year!
• Volunteer leave
• Ongoing learning & development programs and opportunities
• My Coles and Wesfarmers team member discount card
• Be Well Programs – Mind/Body/Soul
• Quarterly All Team events
• Hybrid social events
• New starter kit merchandise

Be You, With Us.Apply today!

We value ways of working that work for everyone and use our different strengths to make us stronger. We work hard to make sure everyone’s voice is heard and respected equally, regardless of identity, background, position, ability or lifestyle.

It is a condition of employment that successful applicants undergo a National Police Check prior to commencing.