Hands-on AppSec Engineer: Secure Coding & APIs

NCS Australia; Sydney; Hybrid; AUD 120,000 - 160,000; Full time

Job summary

NCS Australia in Sydney seeks an Application Security Developer to join our enterprise cybersecurity and engineering group. You will be a hands-on practitioner blending software engineering with application security to secure by design across the SDLC.

Embedded with software squads and security teams, you will enable secure coding practices, implement robust API security, and drive secure design with automated pipelines and vulnerability remediation guidance.

Qualifications

• Deep technical understanding of web/API security, OWASP vulnerabilities, cryptography, and secure auth protocols (OAuth 2.0, OIDC, SAML).
• Practical experience configuring and embedding SAST, SCA and DAST into automated CI/CD workflows.
• Threat modeling ability (e.g., STRIDE) and translating risks into engineering user stories and backlog items.

Responsibilities

• Review code, diagnose vulnerabilities (OWASP Top 10, CWE, LLM-specific risks) and provide remediation guidance in Python, Java, Go, Node.js/TypeScript.
• Design, build, and extend secure application components, authentication/authorization modules, and API security controls with enterprise identity platforms.
• Integrate static, dynamic, and dependency scanning tools into CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps).
• Conduct threat modeling during feature design and perform targeted manual secure code reviews for high-risk components and APIs.
• Partner with Vulnerability Management teams to triage findings and guide remediation strategies.
• Create reusable security libraries and establish secure coding baselines to enable shift-left security practices.

Skills

Application security

API security

CI/CD security

Tools

SAST

SCA

DAST

Job description

NCS Australia in Sydney seeks an Application Security Developer to join our enterprise cybersecurity and engineering group. You will be a hands-on practitioner blending software engineering with application security to secure by design across the SDLC.

Embedded with software squads and security teams, you will enable secure coding practices, implement robust API security, and drive secure design with automated pipelines and vulnerability remediation guidance.