Information Security Specialist

Best Practice Software; Bundaberg; On-site; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Flexible work arrangements

Health IT career development

Growth opportunities

B-Perks Program

Job summary

Best Practice Software in Australia is seeking a senior Information Security Specialist to embed with our product teams from design onwards. You’ll shape architecture decisions, drive threat modelling, and ensure security is built into our development lifecycle.

You’ll own and tune SAST/DAST tooling in CI/CD, manage penetration testing engagements, and help lead our OWASP SAMM maturity roadmap alongside the security directorate, across Bundaberg and Brisbane.

Qualifications

• Practical offensive testing skills across web apps, APIs and services.
• Structured threat modelling sessions with architects and devs.
• Ability to translate risk into testable security requirements.
• Proactive remediation mindset with practical controls.
• Credible collaboration with development teams to influence design.

Responsibilities

• Partner with product and development teams from design to shape architecture decisions.
• Validate exploitability and ensure findings land in backlogs with credibility.
• Embed security into backlog items, acceptance criteria and definition of done.
• Own and tune SAST/DAST tooling in CI/CD to produce signal over noise.
• Own penetration testing program and manage engagements with cadence.
• Help drive the security maturity roadmap alongside the security directorate.

Skills

Practical offensive testing

Threat modelling

Security requirements

Remediation mindset

Credibility with dev teams

Education

Tertiary qualification or accreditation in a related discipline

Tools

.NET

Microsoft SQL Server

Azure-native cloud

Kubernetes

Job description

At Best Practice Software, our vision is communities connected with care. We’re achieving this through our mission to build a culture people love, where:

• we value customers,
• we work together for success,
• we are accountable for our actions,
• we innovate for the future, and
• we celebrate diversity and inclusion.

If you share our vision and values, please consider this exciting career opportunity to join our growing team in Bundaberg or Brisbane, Queensland.

You’re unique, and we value that.

Bp Premier sits inside thousands of Australian general practices and touches the health records of millions of people. The security decisions made in our products matter — and this role is where they get made well. At Best Practice Software, our vision is communities connected with care, and application security is at the core of how we deliver it.

This is a senior, embedded security partner role, not an advisory position. You'll sit within our security directorate but spend much of your time embedded with our product teams and developers, from design onwards — the kind of person who would rather influence a design decision early than write a findings report about it later, and who demonstrates the ability to apply knowledge directly into our product planning and delivery processes.

You’ll have modern tooling behind you (SAST, DAST, CI/CD pipelines, Kubernetes) and a security maturity roadmap (OWASP SAMM) to help drive.

As an Information Security Specialist, we’ll call on your unique talents, skills, expertise, and experience to:

• Partner with our product and development teams from the design stage — facilitating threat modelling and shaping architecture decisions before code is written;
• Validate what matters: demonstrate real exploitability of findings so developers trust what lands in their backlog;
• Build security into the way we work — backlog items, acceptance criteria, PR templates and definition of done, not a separate document nobody reads;
• Own and tune our SAST/DAST tooling in CI/CD so it produces signal, not noise;
• Own our penetration testing program — identifying when a pen test is needed, scoping and managing engagements, driving the output into actioned work, and maintaining a regular testing cadence across our products;
• Help drive our security maturity roadmap (OWASP SAMM) alongside the security directorate.

We believe our ideal applicant will demonstrate the following attributes:

1. Practical offensive testing skills — you can penetration test web applications, APIs and services to a professional standard, working manually beyond automated tooling and demonstrating real exploitability rather than forwarding scanner output

2. Structured threat modelling — you can facilitate threat modelling sessions with architects and developers using recognised approaches (STRIDE, attack trees or similar), and turn the results into prioritised, actionable engineering work

3. Turning risk into clear security requirements — you can translate regulatory, contractual and risk-based drivers into specific, testable security requirements that fit how delivery teams actually work: user stories, acceptance criteria and definition of done, not a separate document nobody reads

4. A remediation mindset, not just a findings mindset — you recommend proportionate, practical controls, talk credibly about trade-offs, compensating controls and residual risk with engineers and risk owners alike, and stay involved until the issue is genuinely closed

5. Credibility with development teams — you explain risk in terms engineers care about, challenge constructively without becoming a blocker, and build enough trust that teams come to you for advice before they build rather than after

Nice to have:

• Experience with regulated health data — Privacy Act / APP 11, notifiable data breaches, ADHA conformance or My Health Record integration — or a working knowledge of the Australian healthcare community and its unique challenges
• Industry certifications such as CSSLP, OSCP, PNPT or CREST — or the drive to earn one
• Experience lifting an organisation's maturity against a framework such as OWASP SAMM
• Development or security experience across .NET, Microsoft SQL Server and Azure-native cloud, including client-server as well as web architectures
• Experience working in application security alongside large development teams
• A tertiary qualification or accreditation in a related discipline — or a demonstrated commitment to progressing your learning and development

What’s in it for you?

• Market-leading benefits that make us a proven local employer of choice.
• Flexible work arrangements that help you strike the right career balance.
• Exciting start to, or positive development of, your Health IT career, with brilliant internal growth opportunities.
• Belong as part of a dynamic and highly supportive team with a strong dedication to the mission.
• Enrich your experience by supporting our frontline healthcare heroes across Australasia.

Our team members enjoy exclusive access to our brilliant B-Perks Program, offering great rewards like birthday leave, an annual health and wellbeing bonus, and sponsored rewards to recognise outstanding contributions. You’ll also access our leadership development program and learning opportunities across our group of businesses and enjoy the freedom and flexibility to work as you work best. We offer purpose and impact, an inclusive culture, a connected workforce, transparent leadership, and growth and belonging.

Your new career starts here.