Hands-On AppSec Engineer: Secure SDLC & API Security

NCS; Sydney; Hybrid; AUD 110,000 - 170,000; Full time

Job summary

NCS Australia is seeking an Application Security Developer to join our Sydney-based enterprise cybersecurity and engineering organization. This hands-on role blends software engineering with deep application security expertise to ensure secure design across the SDLC.

You will work with CIAM, DevSecOps, and Vulnerability Management teams to secure applications, microservices, and AI integrations, implementing secure coding standards and guardrails in modern languages.

Qualifications

• Deep technical understanding of web/API security, OWASP vulnerabilities, cryptography, and secure authentication/authorization protocols (OAuth 2.0, OIDC, SAML).
• Practical experience configuring, tuning, and embedding SAST, SCA, and DAST tooling (e.g., Snyk, Checkmarx, SonarQube, Veracode, OWASP ZAP) into automated CI/CD workflows.
• Practical capability in conducting threat modeling (e.g., STRIDE) and converting security risks into clear engineering user stories and backlog items.

Responsibilities

• Review code for secure coding practices and provide remediation guidance in modern languages (Python, Java, Go, Node.js/TypeScript).
• Design, build, and extend secure application components, authentication/authorization modules, and API security controls.
• Integrate static, dynamic, and dependency scanning tools into CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps).
• Conduct threat modeling during feature design phases and perform targeted manual secure code reviews for high-risk components.

Skills

Web/API security

OWASP vulnerabilities

OAuth 2.0 / OIDC / JWT

CI/CD security tooling

Threat modeling

Education

Security certifications (CSSLP, GWAPT, GWEB, OSCP, CASE)

Tools

Snyk

Checkmarx

SonarQube

Veracode

OWASP ZAP

Job description

NCS Australia is seeking an Application Security Developer to join our Sydney-based enterprise cybersecurity and engineering organization. This hands-on role blends software engineering with deep application security expertise to ensure secure design across the SDLC.

You will work with CIAM, DevSecOps, and Vulnerability Management teams to secure applications, microservices, and AI integrations, implementing secure coding standards and guardrails in modern languages.