Principal Security Engineer - Platform and Cloud

UBank; Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

UBank is seeking a Principal Security Engineer to design and implement platform and cloud security controls across its cloud-native environments. You will own security engineering strategy for Kubernetes, CI/CD pipelines, cloud IAM, and runtime protection, writing production code daily to make secure defaults the normal path.

You will collaborate with cross-functional teams to embed security into developer workflows, build reusable libraries and tooling, and drive security standards across the

Qualifications

• 10+ years in software or security engineering with platform/security focus.
• Experience designing security controls for Kubernetes-based platforms (admission controllers, pod security, network policy).
• Shipping reusable security libraries or automation adopted by product teams.
• Securing CI/CD pipelines and container supply chains (image provenance, vulnerability scanning).
• Experience in regulated financial services or critical infrastructure is desirable.

Responsibilities

• Design and build platform-level security controls across Kubernetes and cloud environments.
• Define cloud IAM patterns and multi-account security baselines.
• Develop security automation and tooling, including runtime detection and security-as-code patterns.
• Lead threat modelling sessions and publish reusable security runbooks and patterns.
• Define and uphold security standards for deployment pipelines and cloud provisioning.

Skills

Kubernetes security

Cloud security

CI/CD security

Admission controllers

Workload identity

Image provenance

eBPF tooling

Security libraries

Automation pipelines

Threat modelling

Tools

OPA/Gatekeeper

Kyverno

Sigstore

Cosign

Falco

Job description

Principal Security Engineer - Platform and Cloud

About Us:
At Ubank, we empower the digital generation to achieve financial success. Think of us as your daily money companion, offering a unified view of your finances with smart features and real-time insights. Save more, track spending, and achieve home ownership faster with Ubank.

The Why:

The Principal Security Engineer (Platform & Cloud) is the hands-on security engineer who designs and builds the platform-level controls, libraries, and automation that make the secure path the default path across ubank's cloud-native environment. This role owns the security engineering strategy for Kubernetes, CI/CD pipelines, cloud IAM, and container runtime protection - writing production code daily to deliver paved-path solutions that product squads adopt by choice, not by mandate.

Working within the Security domain of ubank's Technology group, this role partners closely with platform, infrastructure, and product engineering teams to embed security into the developer experience.

Key Responsibilities:

Platform Security Engineering

• Design and build admission controllers, policy engines, and enforcement mechanisms that make secure defaults automatic across the Kubernetes platform
• Develop and maintain security middleware libraries and SDKs that product squads integrate to handle authentication, authorisation, and secrets management
• Implement container supply chain controls including image signing, provenance verification, and vulnerability gating integrated into CI/CD pipelines

Cloud Security Architecture

• Define and implement cloud IAM patterns, account-level security baselines, and network boundary controls across multi-account cloud environments
• Design service-to-service authentication and workload identity strategies that standardise zero-trust principles across microservices

Security Automation & Tooling

• Build automated security testing and validation pipelines that provide continuous assurance without manual intervention
• Develop runtime security detection capabilities using modern tooling such as eBPF-based observability and behavioural analysis
• Implement security-as-code patterns that generate compliance evidence as a byproduct of engineering workflows

Threat Modelling & Capability Uplift

• Facilitate threat modelling workshops with platform and product engineering squads, teaching teams to identify and mitigate risks independently
• Build and publish reference implementations, runbooks, and golden-path examples that encode security patterns into reusable, adoptable assets

Technical Strategy & Standards

• Define the security engineering roadmap for platform and cloud, aligning technical investment with organisational risk priorities
• Set security standards for deployment pipelines, container registries, and cloud resource provisioning - making the secure way the easy way
• Evaluate and introduce modern security technologies and approaches, ensuring ubank's security posture evolves with the threat landscape

Stakeholder Engagement & Collaboration

• Partner with platform and infrastructure engineering teams to embed security controls natively into shared services and developer tooling
• Engage with product engineering squads to understand developer workflows and ensure security tooling improves - not impedes - delivery velocity
• Provide security engineering guidance to architecture forums and design reviews, contributing production-ready solutions rather than theoretical recommendations

Regulatory & Risk Alignment

• Ensure platform and cloud security controls satisfy APRA CPS 234 and related prudential obligations through engineering-led assurance

Collaborate with risk and compliance teams to translate regulatory requirements into automated, auditable technical controls

Your Experience:

• 10+ years of hands-on software or security engineering experience, with at least 3 years focused on platform security, cloud security, or infrastructure security in a senior or principal capacity.
• Demonstrated experience designing and building security controls for Kubernetes-based platforms, including admission controllers, pod security enforcement, network policy, and workload identity.
• Proven track record of shipping reusable security libraries, middleware, or automation that product engineering teams adopt as the default - not writing policy documents, but writing code.
• Extensive experience securing CI/CD pipelines and container supply chains, including image provenance, vulnerability scanning integration, and build-time policy enforcement.
• Experience in regulated financial services, payments, or critical infrastructure environments is highly desirable.
  Candidates would able to bring in:
• Kubernetes admission control and policy engine development (OPA/Gatekeeper, Kyverno)
• Cloud IAM architecture and multi-account security posture management
• Container supply chain security and image provenance (Sigstore, Cosign)
• Security middleware and SDK development for microservice frameworks
• Threat modelling facilitation and engineering capability uplift
• Runtime security detection and response (eBPF, Falco, or equivalent)

Why Ubank?

• Innovation with impact:From meaningful work to amazing benefits, we equip you with the tools and support to drive real change - so your ideasdon'tjust stay ideas, they become impact.
• Collaborative,supportive& fun:We believe innovation is a team sport. It comes from a special kind of culturethat's highly collaborative and gives people the support they need to thrive.
• Build something great:Ubank is where ambition meets opportunity. Wedon'tjust talk about change - we give you the tools, trust, and support to make it happen.
• Freedom to be yourself:We celebrate individuality and give you the flexibility to work in ways that suit your style. Our hybrid working model lets you balance connection and autonomy.
• Accelerate your Career:With clear paths for career development, your potentialdon'tjust berecognised,it'llbe accelerated.

We acknowledge the Traditional Custodians of our local area.

This Sydney-based permanent role requires Australian or New Zealand citizenship or permanent residency.

We welcome applicantsofall backgrounds, and our Talent team is excited toconnect withyou.