Lead Security Engineer

Morgan McKinley; Sydney; On-site; AUD 140,000 - 170,000; Full time

Job summary

Morgan McKinley is seeking a Senior Security Engineer to join a public sector team in Sydney, Australia. You will help embed security into DevSecOps practices across the product lifecycle and influence across technical and business stakeholders.

Responsibilities include developing cyber security standards, threat modelling, and enabling secure CI/CD pipelines in Azure and AWS. A Baseline/NV1 clearance is required, with 3 years of DevOps-style security work experience.

Qualifications

• 3 years' experience working with DevOps or Software Development teams implementing secure by design principles and automated security testing.
• Strong experience building CI/CD pipelines, with Azure DevOps and AWS Code Suite.
• Excellent communication skills capable of influencing across technical and business stakeholders.
• Experience developing security controls across cloud, infrastructure, applications, networks and endpoints.
• Baseline/NV1 clearance required.

Responsibilities

• Develop cyber security standards to govern system and software implementations.
• Collaborate with internal cyber teams to enable DevSecOps pipelines: policy as code, continuous compliance, risk reporting.
• Conduct threat modelling to map threat landscape to security mitigations.
• Prioritise and manage cyber risk with actionable guidance for teams.
• Assess maturity of development teams and create remediation plans for compliance.
• Develop and maintain application security tooling and integrate with CI/CD pipelines.
• Provide expert guidance for cloud environments and secure CI/CD across product lifecycles.

Skills

DevSecOps

CI/CD pipelines

Azure DevOps

AWS Code Suite

Threat modelling

Security testing automation

Communication

Cloud security controls

Baseline/NV1 clearance

Job description

This is an exciting opportunity to work with a public sector organisation for a Senior Security Engineer with experience working with DevOps/DevSecOps teams.

Responsibilities

• Develop cyber security standards to govern the implementation of systems and software.
• Work with internal cyber teams to identify and implement capability needed to support DevSecOps pipelines such as policy as code, continuous compliance, integrated risk process, dynamic evidence collection and reporting.
• Conducting threat modelling exercises to understand a products threat landscape, processing this information into relevant DevSecOps security mitigations.
• Prioritising and managing Cyber risk, providing teams with actionable recommendations for mitigating and minimising threats in their environment.
• Perform detailed maturity assessments of operational and software development teams, identifying gaps and creating remediation plans to iterate towards high performance and compliance.
• Develop and maintain application security tooling, providing support for adoption and integration with existing CI/CD pipelines, reporting tools, and assurance platforms.
• Provide expert implementation advice for cloud environments, continuous integration and continuous deployment pipelines, with a focus on building security into every stage of a products lifecycle.

Requirements

• 3 years' experience working with DevOps teams or Software Development teams, implementing secure by design principles and automated security testing capabilities.
• Strong Experience building CI/CD pipelines, experience with Azure DevOps and AWS Code Suite.
• Strong communication skills capable of building relationships and influencing outcomes across technical and business stakeholders.
• Experience developing security controls across cloud, infrastructure, applications, networks and endpoints.
• Baseline/NV1 clearance required