Principal Security Engineer (Generalist)

Velqyn; Melbourne; On-site; AUD 180,000 - 260,000; Full time

Job summary

Velqyn is recruiting a Principal Security Engineer in Melbourne to join its Cyber Security Advisory and Consulting Centre of Excellence. You will act as a technical authority across cloud security, application security and risk governance, shaping secure-by-design patterns and leading threat modelling, risk assessments and governance forums.

You will ensure security controls are designed in by default, aligned with APRA CPS 234, CPS 230 and NIST CSF, while guiding identity lifecycle automation

Qualifications

• 15+ years as a security practitioner across cloud security, AppSec, IAM, network security and GRC.
• Proven experience securing hybrid and multi‑cloud workloads on AWS and/or GCP.
• Strong IaC security and automation skills and understanding of DevSecOps, containers and Kubernetes.
• Knowledge of federated identity and identity providers such as Microsoft Entra ID or Okta.
• A strong track record in security risk assessment and risk‑based control design.
• Significant experience in regulated environments, ideally banking and financial services.
• Working knowledge of APRA CPS 234, CPS 230, ISO 27001, NIST CSF, the Essential Eight and the Privacy Act.
• Excellent communication skills and the ability to influence engineers and executives without direct authority.
• Certifications such as CISSP, CISM, CCSP, AWS Security Specialty or Google Professional Cloud Security Engineer are highly regarded.

Responsibilities

• Design secure-by-default patterns and blueprints, including Zero Trust reference architectures.
• Define and govern secure landing zones, network controls and configuration standards across AWS and GCP/GCVE.
• Set guardrails and secure usage patterns for emerging technology, including GenAI and AI-assisted coding tools.
• Work with DevSecOps to embed SAST, DAST, SCA, secrets detection and compliance checks into CI/CD pipelines.
• Lead threat modelling and architecture reviews for high‑risk applications and integrations.
• Run security risk assessments for critical systems, migrations and third‑party integrations.
• Lead security exception and risk acceptance processes, designing practical compensating controls.
• Represent security on risk and governance forums, balancing business speed with risk appetite.
• Make sure designs meet APRA CPS 234 and CPS 230, the Privacy Act 1988 and data residency requirements.
• Define access patterns for federated identity, SSO and PAM, and guide identity lifecycle automation.
• Mentor engineers and grow a strong security champion community.

Skills

Security architecture and governance

Cloud security

IaC security

DevSecOps integration

Threat modelling

Communication with engineers/executive

Regulated banking/financial services

APRA CPS 234/CPS 230 knowledge

Identity & access management

Security certifications (CISSP/CISM/CC

Tools

Terraform

Ansible

Kubernetes

Okta

Microsoft Entra ID

Job description

Our client is a major Australian financial services organisation who is looking for a Principal Security Engineer to join its Cyber Security Advisory and Consulting Centre of Excellence.

This is a senior, high-impact role for a broad security generalist rather than a single-domain specialist. You’ll be a trusted technical authority, connecting hands‑on security engineering, modern solution architecture and risk governance across cloud, application security, identity and threat modelling. Working with product and platform teams, you’ll make sure security controls are built in by design, proportionate to risk and compliant with APRA CPS 234, CPS 230 and NIST CSF.

What you’ll do

• Design secure-by-default patterns and blueprints, including Zero Trust reference architectures
• Define and govern secure landing zones, network controls and configuration standards across AWS and GCP/GCVE
• Set guardrails and secure usage patterns for emerging technology, including GenAI and AI-assisted coding tools
• Work with DevSecOps to embed SAST, DAST, SCA, secrets detection and compliance checks into CI/CD pipelines
• Lead threat modelling and architecture reviews for high‑risk applications and integrations
• Run security risk assessments for critical systems, migrations and third‑party integrations
• Lead security exception and risk acceptance processes, designing practical compensating controls
• Represent security on risk and governance forums, balancing business speed with risk appetite
• Make sure designs meet APRA CPS 234 and CPS 230, the Privacy Act 1988 and data residency requirements
• Define access patterns for federated identity, SSO and PAM, and guide identity lifecycle automation
• Mentor engineers and grow a strong security champion community

What you’ll bring

• 15+ years as a security practitioner across cloud security, AppSec, IAM, network security and GRC
• Proven experience securing hybrid and multi‑cloud workloads on AWS and/or GCP
• Strong IaC security and automation skills (Terraform, Ansible) and a deep understanding of DevSecOps, containers and Kubernetes
• Knowledge of federated identity and identity providers such as Microsoft Entra ID or Okta
• A strong track record in security risk assessment and risk‑based control design
• Significant experience in regulated environments, ideally banking and financial services
• Working knowledge of APRA CPS 234, CPS 230, ISO 27001, NIST CSF, the Essential Eight and the Privacy Act
• Excellent communication skills and the ability to influence engineers and executives without direct authority
• CISSP, CISM, CCSP, AWS Security Specialty or Google Professional Cloud Security Engineer certifications are highly regarded

Why this role

You’ll shape how security is designed and governed across a highly regulated enterprise. You’ll move security away from checklists towards practical, risk‑based engineering that helps the business deliver.

#CyberSecurity #SecurityEngineering #CloudSecurity #DevSecOps #APRA #CPS234 #RiskManagement #FinancialServices #ContractRole #Melbourne #Hiring