Hybrid Security Engineer — Enterprise & App Security

Creditorwatch; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

CreditorWatch is building a dedicated Security Engineering function to actively operate, tune, and integrate security across enterprise and product domains. The Security Engineer will balance IAM, Zero Trust, DLP, SSE, EDR with application security, vulnerability management, and SDLC hardening.

The role spans employee endpoints, SaaS platforms, CI/CD pipelines, cloud infrastructure, and the application layer, reporting to the Principal Product Security Engineer in a hybrid Sydney CBD setting.

Qualifications

• Hands-on experience across multiple security domains as a generalist.
• Experience in app security practices: code review, SAST/SCA, threat modelling.
• Cloud security knowledge with AWS familiarity.
• Ability to embed security into CI/CD and work with engineering teams.
• Strong scripting and automation capability; effective communicator.

Responsibilities

• Improve security posture across SaaS platforms and endpoints.
• Tune and operate enterprise security tools (EDR, SSE, DLP, IAM).
• Drive threat detection, runbooks, and security alert workflows.
• Perform security reviews, threat modelling, and risk assessments.
• Embed security controls in CI/CD pipelines and secure software supply chain.
• Collaborate with Engineering and mentor security champions.
• Support ISO 27001, SOC 2 compliance activities where relevant.

Skills

Generalist security

Application security

Threat modelling

Vulnerability management

Cloud security (AWS)

CI/CD security

IAM & SSO concepts

Scripting (Python/Bash)

Communication

Security tooling knowledge

Tools

Security Hub

Inspector

GuardDuty

SSE/SWG

DLP

EDR

Job description

CreditorWatch is building a dedicated Security Engineering function to actively operate, tune, and integrate security across enterprise and product domains. The Security Engineer will balance IAM, Zero Trust, DLP, SSE, EDR with application security, vulnerability management, and SDLC hardening.

The role spans employee endpoints, SaaS platforms, CI/CD pipelines, cloud infrastructure, and the application layer, reporting to the Principal Product Security Engineer in a hybrid Sydney CBD setting.