Application Security Engineer (Hybrid) – 12‑Month FTC

Rest; Sydney; Hybrid; AUD 140,000 - 170,000; Full time

Benefits offered by this job

Rest Days

Parental leave

Learning & development

Income protection

Leave purchase option

Rest Excellence Awards

Job summary

Rest is seeking an Application Security Engineer for a 12‑month fixed‑term contract based in Sydney, with hybrid work arrangements. You will embed within API and Platform Engineering to mature application security and scale best practices across data, investment and digital engineering teams.

You will triage findings from SAST/DAST/SCA tools, define remediation guidance, and govern secure SDLC controls across design, development, testing, release and maintenance.

Qualifications

• Proven ability to triage and prioritise application security findings.
• Experience with SAST, DAST, SCA, secrets, API, container and IaC scanning.
• Understanding of OWASP Top 10, API Security Top 10, CWEs and software supply‑chain risks.
• Ability to translate technical findings into actionable remediation guidance for engineers.

Responsibilities

• Analyse and triage findings from SAST, DAST, SCA and other tooling, validating impact and identifying false positives.
• Prioritise findings by severity, exploitability, asset criticality, exposure and business context.
• Provide remediation guidance and maintain traceability between findings and remediation tickets.
• Own and coordinate secure SDLC controls across design, development, testing, release and maintenance.
• Govern GitHub source-control security and integrations, including baselines, access reviews, and branch protection.
• Monitor remediation backlog health, risk trends and coordinate risk exemptions through approval, review and expiry.

Skills

SAST

DAST

SCA

OWASP Top 10

GitHub security

Threat triage

Tools

GitHub

CI/CD tooling

Job description

Rest is seeking an Application Security Engineer for a 12‑month fixed‑term contract based in Sydney, with hybrid work arrangements. You will embed within API and Platform Engineering to mature application security and scale best practices across data, investment and digital engineering teams.

You will triage findings from SAST/DAST/SCA tools, define remediation guidance, and govern secure SDLC controls across design, development, testing, release and maintenance.