Cloud Security Engineer

Michael Page; City of Melbourne; On-site; AUD 150,000 - 200,000; Full time

Job summary

Michael Page is seeking an experienced security professional to lead cloud and application security across AWS multi-account environments in a full-time, office-based role in Scoresby, VIC. You will own the security stack, conduct threat modelling, and drive secure SDLC practices with engineering teams.

The role emphasizes hands-on AWS security expertise, IaC with CloudFormation/SAM, and strong collaboration across DevOps and software teams to raise security posture and incident response

Qualifications

• 5+ years' experience in Cloud Security, Application Security, or DevSecOps.
• Experience securing AWS multi-account environments.
• Infrastructure as Code using CloudFormation and/or AWS SAM.
• Security integration within GitHub Actions and/or GitLab CI pipelines.
• Strong hands-on AWS security expertise including: IAM, Identity Center, Security Hub, GuardDuty, WAF, Cognito, AWS Organizations & SCPs.

Responsibilities

• Design, implement, and maintain security guardrails, policies, and compliance controls across multi-account AWS environments.
• Own and mature our AWS security stack, including Identity Center, Security Hub, GuardDuty, WAF, Cognito, IAM, and SCPs.
• Conduct security assessments, threat modelling, and vulnerability analysis across cloud and application environments.
• Partner with software engineering teams to embed application security practices into the SDLC, including secure code review and remediation guidance.
• Support secure AWS IoT Core integration for edge device communication and data flows.

Skills

Cloud Security

Application Security

DevSecOps

Threat Modelling

SAST/DAST

Security in SDLC

Networking Security

Python

Golang

Rust

Tools

CloudFormation

AWS SAM

Identity Center

GuardDuty

Security Hub

WAF

IAM

SAST/DAST tools

GitHub Actions

GitLab CI

Job description

Working Arrangement: 5 days onsite (full-time office-based role)

• Design, implement, and maintain security guardrails, policies, and compliance controls across multi-account AWS environments.
• Own and mature our AWS security stack, including Identity Center, Security Hub, GuardDuty, WAF, Cognito, IAM, and SCPs.
• Conduct security assessments, threat modelling, and vulnerability analysis across cloud and application environments.
• Partner with software engineering teams to embed application security practices into the SDLC, including secure code review and remediation guidance.
• Support secure AWS IoT Core integration for edge device communication and data flows.
• Review and contribute to network security architecture (VPC, Transit Gateway, VPN, Route53) to ensure secure connectivity.
• Implement security controls as code using CloudFormation and/or SAM.
• Integrate security scanning and gates (SAST/DAST, dependency and container scanning) into CI/CD pipelines.
• Drive DevSecOps practices and security awareness across engineering teams.
• Manage identity and access strategy, including Cognito-based authentication and authorisation for applications.
• Lead or support incident response, security investigations, and remediation efforts.
• Monitor emerging threats and continuously improve our security posture and detection capabilities.
• Support secure data workflows involving ingestion, transformation, and storage across cloud systems.
• Stay up to date with AWS security services, emerging threats, and industry best practices.
• Contribute to security documentation, standards, and knowledge sharing within the team.

Location: Scoresby, VIC

Working Arrangement: 5 days onsite (full-time office-based role)

• Design, implement, and maintain security guardrails, policies, and compliance controls across multi-account AWS environments.
• Own and mature our AWS security stack, including Identity Center, Security Hub, GuardDuty, WAF, Cognito, IAM, and SCPs.
• Conduct security assessments, threat modelling, and vulnerability analysis across cloud and application environments.
• Partner with software engineering teams to embed application security practices into the SDLC, including secure code review and remediation guidance.
• Support secure AWS IoT Core integration for edge device communication and data flows.
• Review and contribute to network security architecture (VPC, Transit Gateway, VPN, Route53) to ensure secure connectivity.
• Implement security controls as code using CloudFormation and/or SAM.
• Integrate security scanning and gates (SAST/DAST, dependency and container scanning) into CI/CD pipelines.
• Drive DevSecOps practices and security awareness across engineering teams.
• Manage identity and access strategy, including Cognito-based authentication and authorisation for applications.
• Lead or support incident response, security investigations, and remediation efforts.
• Monitor emerging threats and continuously improve our security posture and detection capabilities.
• Support secure data workflows involving ingestion, transformation, and storage across cloud systems.
• Stay up to date with AWS security services, emerging threats, and industry best practices.
• Contribute to security documentation, standards, and knowledge sharing within the team.

Shape the future of autonomous mobilityOwn and influence the security strategy

• 5+ years' experience in Cloud Security, Application Security, or DevSecOps
• Strong hands-on AWS security expertise including:
  • IAM
  • Identity Center
  • Security Hub
  • GuardDuty
  • WAF
  • Cognito
  • AWS Organizations & SCPs
  • Inspector
• Application Security experience, including:
  • OWASP Top 10
  • Secure code reviews
  • Threat modelling
  • Vulnerability management
  • SAST/DAST tools
• Experience securing AWS multi-account environments
• Infrastructure as Code using CloudFormation and/or AWS SAM
• Security integration within GitHub Actions and/or GitLab CI pipelines
• Programming experience in Python, Golang, or Rust
• Knowledge of networking security including VPCs, VPNs, Transit Gateway, and Route53
• AWS IoT Core security experience highly desirable
• AWS Security Specialty, CISSP, OSCP, or similar certifications advantageous

A pioneering Australian technology company developing software-defined, autonomous transport solutions for commercial mobility applications. Their focus is on creating safety-rated digital vehicle control systems and autonomous-ready platforms that enable smarter, more efficient, and sustainable transportation through advanced cloud, connectivity, and vehicle software technologies.

• Join a company building the future of autonomous and connected transport technology.
• Own and influence cloud security, AppSec, and DevSecOps strategy across a highly innovative engineering environment.