Principal Security Engineer

XPT Software Australia; Melbourne; On-site; AUD 180,000 - 260,000; Full time

Job summary

XPT Software Australia is seeking a Principal Security Engineer (Generalist) to lead security engineering, architecture, and risk governance within the Cybersecurity Advisory and Consulting COE.

This senior role requires a broad, holistic view across cloud security, application security, IAM and threat modeling, with a focus on risk-based control design and secure-by-default patterns to support blended product and platform teams while aligning with APRA CPS 234/230 and NIST CSF.

Qualifications

• Senior leadership in security engineering and risk governance.
• Experience across cloud and hybrid security architectures.
• Ability to conduct comprehensive risk assessments and design risk-based controls.

Responsibilities

• Lead secure-by-default patterns and blueprints (Zero Trust) for rapid secure engineering across product teams.
• Define and govern secure landing zones and network security controls across multi-cloud environments (AWS, GCP).
• Establish security guardrails and secure usage patterns for GenAI/AI tools and SaaS integrations.
• Collaborate with DevSecOps and Platform Engineering to embed automated security checks into CI/CD pipelines.

Skills

Cloud security

Application security

Identity & access management

Threat modeling

Risk management

Governance

SAST

DAST

SCA

Tools

SAST

DAST

SCA

Job description

The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.

Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including cloud security (multi-cloud), application security, identity & access management, and threat modeling.

Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.

Requirements

Key Responsibilities and Accountabilities

Security Engineering, Architecture & Solution Design

• Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.
• Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).
• Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.
• Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure 'front door' and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.

Collaborative Threat Modeling

Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements