Principal Security Engineer

XPT Software Australia Pty Ltd; Melbourne; On-site; AUD 180,000 - 230,000; Full time

Job summary

XPT Software Australia Pty Ltd in Melbourne is seeking a Principal Security Engineer to lead security across cloud and application domains, shaping architecture, governance and risk programs.

You will drive cloud security using AWS and/or GCP, implement Zero Trust, IAM controls, DevSecOps, and SAST/DAST; collaborate with stakeholders and guide teams.

Qualifications

• Broad cybersecurity expertise spanning hands-on security engineering, architecture and governance.
• Experience with AWS and/or GCP cloud security.
• Strong ability to design security architectures and threat models.

Skills

Cloud security

Security architecture

Zero Trust

Threat modelling

AppSec

DevSecOps

IAM & SSO

PAM

Automation

CI/CD

SAST/DAST/SCA

IaC (Terraform/Ansible)

Risk management

Regulatory compliance

Compliance standards

Stakeholder mgmt

Tech leadership

CISSP

CISM

CCSP

Tools

Terraform

Ansible

Job description

XPT Software Australia Pty Ltd | Contract

Principal Security Engineer

Melbourne, Australia | Posted on 11/05/2026

• XPT SoftwareAustralia PTY Ltd, incorporated in 2016, is a Software Services company
  
• XPT works with topclients across Australia in Banking, Insurance, Telecom,Retail, Energy, Mining and Manufacturingdomains.
  
• We have 120+technocrats in Australia working at our clientlocations.
  
• XPT SoftwareAustralia is part of group companies which has globalpresence across India & Europe.
  
• We have served100+ clients globally, fulfilling their onsite-offshoreneeds.
  

Job Description

We are looking for an experienced Principal Security Engineer with strong expertise across Cloud Security, Application Security, IAM, DevSecOps, Security Architecture and Governance, Risk & Compliance (GRC).

Key Skills Required:

Strong experience in AWS and/or GCP Cloud Security.

Security Architecture, Zero Trust and Threat Modelling.

Application Security (AppSec) and DevSecOps.

IAM – SSO, OAuth 2.0, SAML and PAM.

Security automation, CI/CD, SAST, DAST and SCA.

Infrastructure as Code – Terraform and Ansible.

Security Risk Assessments and Risk Management.

Regulatory compliance – APRA CPS 234, CPS 230, ISO 27001 and NIST CSF.

Strong stakeholder management, consulting and technical leadership skills.

Preferred: CISSP, CISM, CCSP or cloud security certifications.

Note: Candidates must have broad cybersecurity experience combining hands-on security engineering, architecture and risk governance.