AppSec Engineer: Shape a New Security Function (Hybrid)

PRA; Sydney; Hybrid; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Hybrid Sydney CBD office

Job summary

PRA is building a brand-new Security Engineering function in Sydney CBD, offering a hybrid work setup. The role spans both product and enterprise security, reporting to a Principal Product Security Engineer and partnering with Engineering and the wider business.

You will embed security into delivery, run reviews and threat modelling, strengthen the software supply chain, and implement enterprise security tools across IAM, EDR, SSE, DLP, and email security; promoting least privilege and Zero

Qualifications

• Hands-on security across product and enterprise domains.
• Secure code review, threat modelling and vulnerability management in cloud-native/SaaS.
• Experience with AWS security features and IAM.
• Knowledge of SSO, OAuth, OIDC, SAML and conditional access.
• Ability to script in Python or Bash and explain risk to engineers.

Responsibilities

• Embed security into delivery by integrating SAST/SCA and secrets detection into CI/CD pipelines.
• Conduct security reviews, threat modelling and risk assessments; drive remediations.
• Strengthen software supply chain and CI/CD security; enable secure AI/ML adoption.
• Operate enterprise security tools across IAM, EDR, SSE, DLP and email security; apply Zero Trust.
• Improve vulnerability management, detection, alerts, and incident response; support ISO 27001 and SOC 2.

Skills

SAST/SCA tooling

Threat modelling

Vuln management

CI/CD security

Python/Bash scripting

AWS security

IAM/OAuth/SAML

Zero Trust

Tools

SAST tooling

SCA tooling

IAM tools

EDR tooling

DLP tools

Job description

PRA is building a brand-new Security Engineering function in Sydney CBD, offering a hybrid work setup. The role spans both product and enterprise security, reporting to a Principal Product Security Engineer and partnering with Engineering and the wider business.

You will embed security into delivery, run reviews and threat modelling, strengthen the software supply chain, and implement enterprise security tools across IAM, EDR, SSE, DLP, and email security; promoting least privilege and Zero