Application Security Manager

Decipher Bureau; Melbourne; Presencial; AUD 150 000 - 210 000; Tempo integral

Resumo da oferta

Decipher Bureau in Melbourne is seeking an Application Security Manager to build a brand-new AppSec function and shape how security is integrated from the ground up. You will lead a small team including a Cyber Security Architect and Application Security Engineers, driving secure design and threat modelling across projects.

This role offers a chance to establish a capability within a large organisation, with a focus on advisory work, governance and meaningful delivery across critical systems.

Qualificações

• Hands-on AppSec expertise spanning design reviews, threat modelling and remediation.
• Builder mindset; comfortable tackling ambiguity and creating new capability.
• Strong communication to influence technical and business stakeholders.
• Experience embedding DevSecOps into delivery pipelines.

Responsabilidades

• Build the AppSec function from ground up, establishing standards, patterns and assurance processes.
• Own security architecture input and secure-by-design practices across delivery.
• Embed DevSecOps into delivery pipelines where feasible.
• Lead risk assessments, design reviews, threat modelling and remediation oversight.
• Collaborate with delivery teams, risk, tech, and partners to raise security posture.
• Report on application risk, gaps and remediation progress to leadership.

Conhecimentos

Application security

Threat modelling

Secure design reviews

Security testing

Leadership

Stakeholder influence

Communication

Descrição da oferta de emprego

Application Security Manager | Greenfield Build | Melbourne (open to other cities)

Ever wanted to build an application security function from scratch, your way?

This is a rare chance to establish a brand new AppSec team inside a large, diverse organisation. It’s a complex and highly regulated environment, but the culture is genuinely flexible, and the security function is backing in-house capability over off-the-shelf fixes.

The opportunity

Reporting to the Head of Security Engineering & Platforms as the 2ic, you’ll own the application security advisory capability. This is not a platforms or engineering-ops role: your focus is advisory, architecture and setting the direction for how applications are designed, built and secured across the business.

This is a great opportunity for an application security engineer or lead to step up into a management role. You’ll lead a small team including a Cyber Security Architect and Application Security Engineers.

What you’ll be doing

• Building the AppSec function from the ground up, including standards, patterns, control requirements and assurance processes
• Owning security architecture input and secure-by-design practices across application delivery
• Embedding DevSecOps practices into delivery pipelines where they make sense
• Leading application risk assessments, design reviews and threat modelling, plus oversight of security testing and remediation
• Working closely with delivery teams, architects, risk, technology and strategic partners to lift application security posture
• Reporting on application risk, control gaps, remediation progress and capability maturity

What we’re looking for

• Solid application security background, with hands-on experience in secure design reviews, threat modelling, security testing and vulnerability remediation
• A builder’s mindset: comfortable with ambiguity and excited by creating something new rather than maintaining something established
• Curiosity and willingness to learn. Attitude and capability matter more than a perfect checklist
• Strong communication skills and the ability to influence both technical and business stakeholders

On tooling

The team is tool-agnostic. Modern AppSec platforms are being explored, but what you bring to the table matters far more than which tools you’ve used. You’ll have real input into the approach.

Why this role?

• Genuinely greenfield work, with your fingerprints on the function from day one
• A step into leadership with the scope and backing to shape a capability
• Varied, meaningful environment across critical infrastructure and essential services
• Super flexible working: 2-3 days in the office, with Tuesday as the team anchor day