Hybrid-Remote AppSec Lead: Secure DevOps & .NET

MedHealth; City of Melbourne; Hybrid; AUD 140,000 - 180,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

MedHealth is seeking an experienced Application Security Technical Lead to own and run application security across the SDLC, with hands-on responsibility to embed secure practices, tooling and processes into development workflows.

You will collaborate with multiple development teams, uplift security maturity, perform secure code reviews (C#, .NET) and lead threat modelling and security assessments across applications and automation workflows. Hybrid work arrangement offered.

Qualifications

• 5+ years' experience in software engineering including 2+ in an application security role.
• Strong experience with DevSecOps and CI/CD environments
• Hands-on experience with AppSec tools (SAST, DAST, SCA)
• Strong experience working in Azure environments and Azure DevOps pipelines
• Comfortable reviewing code (C#, .NET, web applications)
• Strong understanding of OWASP Top 10 and secure design principles
• Experience working across multiple teams or platforms with varying maturity levels
• Able to adapt approach based on risk, complexity and delivery context
• Self-driven, accountable and strong at stakeholder engagement

Responsibilities

• Own and operate application security across the SDLC
• Identify and assess application security risks, partnering with Engineering teams on remediation
• Perform secure code reviews (primarily .NET) and support secure development practices
• Lead threat modelling and security assessments across applications and automation workflows
• Adapt security practices to suit different team maturity levels, balancing uplift, standardisation and delivery needs
• Own and optimise AppSec tooling (SAST, DAST, SCA) across CI/CD pipelines
• Ensure effective security testing without impacting delivery velocity
• Own vulnerability visibility, prioritisation and reporting
• Define and apply secure design and development standards
• Establish Security Champions across development teams
• Mentor developers and uplift secure coding capability across teams

Skills

Software engineering

Application Security

DevSecOps

CI/CD

Azure

OWASP Top 10

Code review

Stakeholder engagement

Tools

SAST

DAST

SCA

Job description

MedHealth is seeking an experienced Application Security Technical Lead to own and run application security across the SDLC, with hands-on responsibility to embed secure practices, tooling and processes into development workflows.

You will collaborate with multiple development teams, uplift security maturity, perform secure code reviews (C#, .NET) and lead threat modelling and security assessments across applications and automation workflows. Hybrid work arrangement offered.