Offensive Security Engineer at UST

UST; Sydney; On-site; AUD 120,000 - 170,000; Full time

Benefits offered by this job

Flexible/hybrid working arrangements

Health insurance

Novated Car Lease

Access to UST Perks

Job summary

UST is seeking an Offensive Security Engineer to join our team on a short-term, full-time, on-site contract. You will specialise in practical security testing, threat emulation, automation, and vulnerability lifecycle management in enterprise environments.

Key responsibilities include authorised, risk-based testing across cloud workloads, APIs, networks, and applications; managing CSPM, SAST, DAST tooling; and driving secure development by embedding security in the SDLC.

Qualifications

• Proven background in security testing and vuln management.
• Experience with cloud, API, and web app security.
• Familiarity with CSPM, SAST, DAST platforms.
• Strong scripting skills for automation.

Responsibilities

• Conduct authorised, risk-based security testing across cloud workloads, identity services, networks, infrastructure, web applications, and APIs.
• Manage, administer, and optimise core security testing platforms, including CSPM, SAST, DAST, and attack simulation tools.
• Drive secure development practices by embedding security testing early in the SDLC.
• Integrate open-source risk, dependency, AppSec, API, and DAST security controls into CI/CD pipelines, code repositories, and IDEs.
• Execute authorised penetration testing, threat modelling, security design reviews, and technical assessments for material changes.
• Document, triage, and validate security findings, capturing critical details such as business impact, severity, accountable owners, remediation targets, and closure evidence.
• Monitor remediation progress, retest resolved issues, and escalate material or overdue vulnerabilities.
• Utilise CSPM tooling to evaluate compliance posture, attack paths, misconfigurations, and cloud vulnerabilities.
• Execute MITRE ATT&CK-aligned adversary emulation, control validation, and purple team initiatives.
• Supply actionable remediation guidance to technology teams, utilising standards like the OWASP Top 10, secure AI development practices, and PCI DSS coding requirements.
• Automate repetitive tasks across testing, discovery, ticketing, remediation tracking, validation, and reporting.
• Develop evidence-based metrics, reports, and control-effectiveness insights for audit, executive, operational, and governance stakeholders.

Skills

DevSecOps

Application security

Penetration testing

Security engineering

Cybersecurity

Cloud security

CI/CD

Python

PowerShell

Stakeholder engagement

Tools

CSPM

SAST

DAST

Job description

This Full time on site position offers great opportunities for career growth.

Role description

We are looking for an Offensive Security Engineer to join team on a short-term contract. This role is ideal for a technical professional who excels at practical security testing, threat emulation, automation, and vulnerability lifecycle management in enterprise environments.

Key Responsibilities

• Conduct authorised, risk-based security testing across cloud workloads, identity services, networks, infrastructure, web applications, and APIs.
• Manage, administer, and optimise core security testing platforms, including CSPM, SAST, DAST, and attack simulation tools.
• Drive secure development practices by embedding security testing early in the SDLC.
• Integrate open-source risk, dependency, AppSec, API, and DAST security controls into CI/CD pipelines, code repositories, and IDEs.
• Execute authorised penetration testing, threat modelling, security design reviews, and technical assessments for material changes.
• Document, triage, and validate security findings, capturing critical details such as business impact, severity, accountable owners, remediation targets, and closure evidence.
• Monitor remediation progress, retest resolved issues, and escalate material or overdue vulnerabilities.
• Utilise CSPM tooling to evaluate compliance posture, attack paths, misconfigurations, and cloud vulnerabilities.
• Execute MITRE ATT&CK-aligned adversary emulation, control validation, and purple team initiatives.
• Supply actionable remediation guidance to technology teams, utilising standards like the OWASP Top 10, secure AI development practices, and PCI DSS coding requirements.
• Automate repetitive tasks across testing, discovery, ticketing, remediation tracking, validation, and reporting.
• Develop evidence-based metrics, reports, and control-effectiveness insights for audit, executive, operational, and governance stakeholders.

Required Skills and Experience

• Professional background in DevSecOps, application security, penetration testing, security engineering, or cybersecurity.
• Knowledge of cloud, API, and web application security.
• Practical experience operating security testing platforms such as CSPM, SAST, and DAST.
• Solid understanding of CI/CD environments and secure software development practices.
• Demonstrated experience in discovering, validating, and remediating security vulnerabilities.
• Working knowledge of major security frameworks, including NIST, ISO 27001, PCI DSS, MITRE ATT&CK, and the OWASP Top 10.
• Scripting proficiency (e.g., Python or PowerShell) to automate workflows & tasks.
• Strong communication abilities with a proven track record of effective stakeholder engagement.

Benefits & Perks

• Flexible/hybrid working arrangements.
• Health insurance.
• Novated Car Lease.
• Access to UST Perks (Reward Gateway), which offers discounts across major retailers.

Our commitment to Diversity, Equity and Inclusion Diversity and Inclusion are among the founding blocks of how UST as an organisation translates its values of Humility, Humanity, and Integrity into practice.

About UST

For more than 25 years, UST has worked side by side with the world's best companies to make a real impact through digital transformation. Together, with over 30,000 employees in 30+ countries, we build for boundless impact - touching billions of lives in the process. #LI-BM Skills Application Security, Security Engineering, Vulnerability Management, Vulnerability Assessment and Penetration Testing, Threat Modeling, SAST, DAST, Python, PowerShell, DevSecOps, ISO 27001

About UST

UST is a global digital transformation solutions provider. For more than 20 years, UST has worked side by side with the world's best companies to make a real impact through transformation. Powered by technology, inspired by people and led by purpose, UST partners with their clients from design to operation. With deep domain expertise and a future‑proof philosophy, UST embeds innovation and agility into their clients' organisations. With over 30,000 employees in 30 countries, UST builds for boundless impact - touching billions of lives in the process.