AppSec & Cloud Security Lead — Hybrid Sydney

Checkbox AI; Sydney; Hybrid; AUD 180,000 - 260,000; Full time

Benefits offered by this job

Hybrid working in Sydney CBD office

Competitive salary and equity

Learning and development budget

Flexible leave policy

Expense policy and salary sacrifice

CBD startup hub with snacks and coffee

Team socials and annual off-sites

Job summary

Checkbox AI is seeking a hands-on Principal Security Engineer to own application security, cloud and infrastructure security, SIEM, vulnerability management and compliance initiatives for an AI-first SaaS platform. You will work across product, engineering, platform and customer-facing teams to embed security into design, build, deploy and operate cycles.

The role emphasizes practical engineering, fast remediation, and shaping AI security guardrails while leading SOC 2, ISO 27001, ISO 27017 and

Qualifications

• Strong experience in application security, infrastructure security, cloud security or security engineering roles.
• Experience securing modern SaaS web applications, APIs and cloud-based platforms.
• Strong AWS experience, with good understanding of Kubernetes and containerisation technologies.
• Experience with SIEM ownership, detection engineering, incident response or security monitoring.
• Experience leading vulnerability management, penetration testing programs and remediation efforts.
• Strong understanding of SAST, DAST, secure SDLC practices and practical application security controls.
• Extensive experience with compliance frameworks and audits, including internal and external audits.
• Experience supporting SOC 2, ISO 27001, ISO 27017 or ISO 27018 certification from early preparation through to audit completion.
• Experience preparing, reviewing and maintaining security policies, evidence and control documentation.
• Experience with GRC platforms such as Vanta, Drata or similar.
• Experience with infrastructure-as-code tools such as Terraform, OpenTofu, CloudFormation or Ansible.
• Proficiency in at least one modern programming language such as Go or TypeScript.
• Strong scripting capability, with Bash as a minimum.
• Understanding of CI/CD tooling such as GitHub Actions, ArgoCD or equivalent technologies.
• Familiarity with modern AI tooling such as Copilot, Claude or Cursor for AI-assisted daily work.
• Strong communication skills and the credibility to lead customer-facing security conversations.
• Proven ability to lead security initiatives end to end, align multiple stakeholders and help others improve their security practices.
• Comfortable working in dynamic start-up or scale-up environments where priorities evolve quickly.
• Hands-on, pragmatic and comfortable moving between strategy, implementation, remediation and customer conversations.

Responsibilities

• Lead application security and infrastructure security practices across Checkbox, including secure development, cloud security, SaaS application security, API security and security reviews for new architectures and product capabilities
• Own the company SIEM from detection through to response, including alerting, investigation workflows, response processes and continuous improvement of security visibility
• Lead vulnerability management across detection, triage, prioritisation, patching and remediation, including coordination of internal and external penetration tests
• Evaluate, introduce and optimise security tooling, including SAST, DAST, SIEM, vulnerability management and other controls that support secure engineering at scale
• Lead compliance initiatives, audits and recertifications across SOC 2, ISO 27001, ISO 27017, ISO 27018 and related trust programs
• Own security policies, evidence, controls, audit documentation, the company trust centre and related customer trust projects
• Act as the point person for customer security queries, including questionnaires, customer reviews, prospect security assessments and customer‑facing security meetings
• Build practical AI security guardrails for internal teams using tools such as Copilot, Claude, Cursor and other AI‑assisted workflows
• Partner closely with Product, Engineering, Platform, Identity, IT, Sales, Customer Success and Legal to ensure security is practical, scalable and embedded into how the business operates

Skills

Application security

Cloud security

AWS

Kubernetes

SIEM ownership

Vulnerability management

Penetration testing

Secure SDLC

Compliance audits

GRC platforms

Terraform

OpenTofu

CloudFormation

Ansible

GitHub Actions

ArgoCD

Go/TypeScript

Bash scripting

CI/CD tooling

AI tooling

Communication

Startup environment

Customer security conversations

Tools

Terraform

OpenTofu

CloudFormation

Ansible

GitHub Actions

ArgoCD

Job description

Checkbox AI is seeking a hands-on Principal Security Engineer to own application security, cloud and infrastructure security, SIEM, vulnerability management and compliance initiatives for an AI-first SaaS platform. You will work across product, engineering, platform and customer-facing teams to embed security into design, build, deploy and operate cycles.

The role emphasizes practical engineering, fast remediation, and shaping AI security guardrails while leading SOC 2, ISO 27001, ISO 27017 and