Information Security Engineer

Decipher Bureau; Melbourne; Hybrid; AUD 144,000 - 176,000; Full time

Benefits offered by this job

Hybrid working

Discounted health insurance

Salary sacrifice options

14 weeks' parental leave

End-of-trip facilities

Wellbeing support & EAP

Job summary

Decipher Bureau is seeking an Information Security Engineer in Melbourne to lead cloud security uplift initiatives across Azure/M365 and SaaS visibility. The role balances hands-on engineering with strategic guidance in a flexible, hybrid setup with 2 on-site days per week.

The successful candidate will assess current Cloudflare and web proxy posture, contribute to cloud controls, and work with external consultants on vulnerability management, while collaborating with infrastructure and service

Qualifications

• Hands-on cloud security experience with Azure/M365.
• Ability to work with minimal supervision and steer projects.
• Experience defining security controls and assessing risk.
• Knowledge of NIST CSF and NIST Controls.
• Relevant degree or equivalent experience in information security/IT.

Responsibilities

• Assess current-state Cloudflare/web proxy posture and lead uplift once approved.
• Contribute to Microsoft cloud controls assessment including SaaS visibility.
• Support vulnerability management uplift with external consultants.
• Take on integration engineering as new security capabilities are built.
• Engage with infrastructure, cloud, and service delivery teams to gather context and produce clear recommendations.
• Maintain up-to-date runbooks and escalation procedures with new tooling.

Skills

Cloud security

Azure/M365

Self-directed

Risk assessment

NIST CSF

Education

Bachelor's degree in Information Security/IT

Tools

Cloudflare

Job description

Information Security Engineer:

Cloud security & web proxy uplift (18-month FTC, $160k + super)

This organisation is one of Australia's largest not-for-profit health insurers, and their information security engineering team is growing as part of a well-funded, genuinely strategic security transformation program. This is a full-time fixed-term role for 18 months, reporting to the Information Security Engineering Lead, with 2 days a week on-site and the remainder remote, genuinely flexible on location for the right candidate.

The core of this role is assessing where current cloud and web-proxy controls sit (Cloudflare is already deployed) and mapping out where they need to get to, then leading the uplift once that's agreed. You'll also get involved in Microsoft cloud posture and SaaS visibility work, and some vulnerability management. It's a hands-on role, but it's also genuinely a figure-it-out-and-present-back kind of job; you'll be given a steer, not a script, so the organisation cares more about your judgment and self-direction than a perfect skills checklist.

What you'll be doing

• Assess current-state Cloudflare / web proxy posture, identify gaps, and lead the uplift once recommendations are agreed
• Contribute to a Microsoft cloud controls and posture assessment including SaaS visibility and E5 licensing utilisation across a modern, SaaS-heavy stack
• Support the organisation's vulnerability management uplift, working alongside external consultants currently assessing the current state
• Pick up integration engineering work as new security capability continues to be built out
• Engage directly with stakeholders (infrastructure, cloud, service delivery teams) to gather context, form a current-state picture, and bring back clear, concise recommendations
• Keep documentation, runbooks and escalation procedures current as new tooling and controls are rolled out

What you'll bring

Must-have:

• Strong, hands-on cloud security experience, ideally Microsoft/Azure/M365
• Comfortable self-directing, able to take a high-level steer, find the right people, gather what's needed, and form your own recommendations
• Experience defining technical Information Security controls and assessing risk
• Understanding of NIST CSF and NIST Controls
• Tertiary qualification in Information Security or Information Technology (or significant equivalent experience in broader technology-based roles)

Desirable:

• Experience with Cloudflare or similar web proxy / CASB-type platforms
• Vulnerability management experience from an engineering perspective
• Broader SOC/SIEM and security operations background
• Experience in private health insurance or another similarly regulated industry
• Technical cyber security certifications or vendor-specific certifications
• Familiarity with regulatory requirements (e.g. CPS 234, Privacy Act) and industry standards

What's in it for you:

• Hybrid working model flexibility to split time between the office and off-site
• Discounted health insurance for you and, after probation, your immediate family
• Salary sacrifice options, including novated car leasing and additional super
• 14 weeks' paid parental leave, plus the option to purchase up to 4 weeks' extra annual leave
• A modern, sustainability-rated office with end-of-trip facilities
• Ongoing training and development, plus 24/7 wellbeing support and an Employee Assistance Program

About Decipher Bureau

The Decipher Bureau is Australia's leading cyber security recruitment specialist, partnering with organisations across government, critical infrastructure and enterprise to identify and secure exceptional talent. We take the time to understand both the technical requirements of a role and a candidate's cultural fit, in the belief that the right placement will always outweigh a quick one.

(We are committed to creating a diverse and inclusive workplace. All qualified applicants will be considered for employment without regard to race, colour, religion, sex, sexual orientation, gender identity, national origin, or disability.)