Application Security Engineer — Secure SDLC Lead

Hydrogen Group; Sydney; On-site; AUD 120,000 - 160,000; Full time

Job summary

Hydrogen Group is seeking an Application Security Engineer to join the Software Engineering group in Sydney. You will build on an existing engineering practice and drive risk-based remediation across data, investment and digital teams.

You will prioritise findings, provide actionable guidance to engineering teams, and own secure SDLC controls from design to maintenance. You will oversee GitHub security and drive evidence-based closure of vulnerabilities.

Qualifications

• Strong analytical skills and a track record of triaging and prioritising application security findings.
• Experience with SAST, DAST, SCA, secrets, API, container and infrastructure-as-code scanning, plus OWASP Top 10, API Security Top 10, common CWEs and software supply-chain risks.
• Experience defining, implementing and assessing secure SDLC controls across the full lifecycle.
• The ability to turn technical findings into clear, actionable guidance for engineering teams.
• Experience with vulnerability management workflows, ticketing, backlog management, reporting and evidence-based closure.
• Deep GitHub security knowledge, including repository governance, access models, branch protection, pull-request controls, code ownership, GitHub’s security features and application security integrations.
• Strong stakeholder engagement, written communication and follow-through.

Responsibilities

• Review results from application security tools (SAST, DAST, SCA etc.) and confirm genuine impact; filter false positives.
• Rank findings by severity, exploitability, asset exposure and business context; align with vulnerability management.
• Provide engineers clear, practical fix guidance and maintain traceability from finding to remediation ticket.
• Own secure SDLC controls from design through maintenance, including requirements, guidance, evidence and reviews.
• Oversee GitHub security: repository baselines, access reviews, branch protection, PR rules, code ownership, secrets protection and related integrations.
• Report on remediation backlog health and trends; escalate overdue items; manage risk exemptions from approval to expiry.

Skills

Analytical skills

SAST

DAST

SCA

IaC scanning

Secure SDLC

GitHub security

Stakeholder mgmt

Written comms

Backlog mgmt

Tools

GitHub

CI/CD tooling

Security tooling

Job description

Hydrogen Group is seeking an Application Security Engineer to join the Software Engineering group in Sydney. You will build on an existing engineering practice and drive risk-based remediation across data, investment and digital teams.

You will prioritise findings, provide actionable guidance to engineering teams, and own secure SDLC controls from design to maintenance. You will oversee GitHub security and drive evidence-based closure of vulnerabilities.