Offensive Security Engineer - Threat Emulation & DevSecOps

UST; Sydney; On-site; AUD 120,000 - 170,000; Full time

Benefits offered by this job

Flexible/hybrid working arrangements

Health insurance

Novated Car Lease

Access to UST Perks

Job summary

UST is seeking an Offensive Security Engineer to join our team on a short-term, full-time, on-site contract. You will specialise in practical security testing, threat emulation, automation, and vulnerability lifecycle management in enterprise environments.

Key responsibilities include authorised, risk-based testing across cloud workloads, APIs, networks, and applications; managing CSPM, SAST, DAST tooling; and driving secure development by embedding security in the SDLC.

Qualifications

• Proven background in security testing and vuln management.
• Experience with cloud, API, and web app security.
• Familiarity with CSPM, SAST, DAST platforms.
• Strong scripting skills for automation.

Responsibilities

• Conduct authorised, risk-based security testing across cloud workloads, identity services, networks, infrastructure, web applications, and APIs.
• Manage, administer, and optimise core security testing platforms, including CSPM, SAST, DAST, and attack simulation tools.
• Drive secure development practices by embedding security testing early in the SDLC.
• Integrate open-source risk, dependency, AppSec, API, and DAST security controls into CI/CD pipelines, code repositories, and IDEs.
• Execute authorised penetration testing, threat modelling, security design reviews, and technical assessments for material changes.
• Document, triage, and validate security findings, capturing critical details such as business impact, severity, accountable owners, remediation targets, and closure evidence.
• Monitor remediation progress, retest resolved issues, and escalate material or overdue vulnerabilities.
• Utilise CSPM tooling to evaluate compliance posture, attack paths, misconfigurations, and cloud vulnerabilities.
• Execute MITRE ATT&CK-aligned adversary emulation, control validation, and purple team initiatives.
• Supply actionable remediation guidance to technology teams, utilising standards like the OWASP Top 10, secure AI development practices, and PCI DSS coding requirements.
• Automate repetitive tasks across testing, discovery, ticketing, remediation tracking, validation, and reporting.
• Develop evidence-based metrics, reports, and control-effectiveness insights for audit, executive, operational, and governance stakeholders.

Skills

DevSecOps

Application security

Penetration testing

Security engineering

Cybersecurity

Cloud security

CI/CD

Python

PowerShell

Stakeholder engagement

Tools

CSPM

SAST

DAST

Job description

UST is seeking an Offensive Security Engineer to join our team on a short-term, full-time, on-site contract. You will specialise in practical security testing, threat emulation, automation, and vulnerability lifecycle management in enterprise environments.

Key responsibilities include authorised, risk-based testing across cloud workloads, APIs, networks, and applications; managing CSPM, SAST, DAST tooling; and driving secure development by embedding security in the SDLC.