Principal Security Engineer

XPT Software; Melbourne; Presencial; AUD 180 000 - 260 000; Tempo integral

Resumo da oferta

XPT Software seeks a Principal Security Engineer (Generalist) to serve as a senior technical authority, bridging deep security engineering, solution architecture, and risk governance. You will drive secure-by-design patterns across multi-cloud environments while guiding risk-based controls and regulatory compliance in a consulting-focused COE.

The role emphasizes design leadership across cloud, application security, identity & access management, and threat modeling, with a focus on enabling

Responsabilidades

• Lead the design, implementation and maintenance of secure-by-default patterns and blueprints (Zero Trust reference architectures) across product teams.
• Define and govern secure landing zones, network security controls, and secure configuration standards across hybrid-/multi-cloud environments (AWS and GCP/GCVE).
• Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.
• Partner with DevSecOps and Platform Engineering to automate secure entry points and self-service delivery, embedding SAST/DAST/SCA, secrets discovery, and compliance checks into pipelines.
• Lead architectural reviews and threat modeling sessions for high-risk enterprise applications and convert threats into actionable engineering requirements.

Conhecimentos

Security architecture

Threat modeling

Zero Trust

Multi-cloud security

DevSecOps collaboration

AI governance

Ferramentas

SAST/DAST/SCA

VPC/Network security controls

Descrição da oferta de emprego

The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.

Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including

cloud security (multi-cloud), application security, identity & access management, and threat modeling.

Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.

Requirements

Key Responsibilities and Accountabilities

Security Engineering, Architecture & Solution Design

• Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.
• Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).
• Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.
• Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.
• Collaborative Threat Modeling: Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements