Product Security Engineer (Secure Software)

Boeing; Brisbane; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Flexible work from home

Annual bonus

Mentoring and training

Salary packaging options

Health & wellbeing benefits

Defence leave

Job summary

Boeing Defence Australia (BDA) seeks a senior Product Security Engineer to embed secure software development across the MQ-28 program. You will craft architecture patterns and lead LLM security within toolchains and autonomy applications.

The role requires hands-on security engineering experience, risk-based design, and collaboration across engineering teams to meet ISM, DSPF and NIST controls. Brisbane-based with flexible work options.

Qualifications

• Tertiary degree in engineering or related field.
• Experience applying engineering practices across the development lifecycle.
• Hands-on with CI pipelines and SAST/dep scanning.
• Security architecture experience in regulated environments.
• Working knowledge of LLM security in AI/safety contexts.
• Security certification (e.g. CompTIA+, CISSP, CISM, SSCP).
• Defence/government security experience and NV1 clearance.

Responsibilities

• Embed secure software development into the MQ-28 program.
• Develop reference security patterns for services and data flows.
• Coach DevSecOps engineers in threat modelling and secure design.
• Produce evidence for system accreditation during the pipeline.

Skills

Threat modelling

Secure software development

DevSecOps

Security architecture

LLM security

Communication

Collaboration

Education

Engineering degree

Tools

SAST tooling

DAST tooling

SBOM generation

CI/CD pipelines

C/C++

Rust

Ada

Job description

Product Security Engineer (Secure Software)

Do you aspire to help build something better? Would you like to work for a company that employs the best talent to develop and deliver world class capabilities and systems to protect Australia and its national interests? Would you like to work on cutting edge projects? Then we would like to talk to you.

As an equal opportunity employer that promotes a diverse and safe workplace environment, one of the country's leading and preferred defence partners, Boeing Defence Australia (BDA) is now recruiting a System Security Technical Lead in Brisbane to support the MQ-28 Program.

The Opportunity

We are seeking a senior product security engineer to lead the implementation and embedding of secure software development practices on the MQ-28 program. You will lead the development of architecture patterns that engineering teams will use. You will also lead the development and implementation of LLM security in a development toolchains and in mission autonomy applications.

The successful candidate will have comprehensive awareness and practical experience applying product security engineering design practices, experience embedded secure software development practices, and experience with AI or ML in safety-related or autonomous systems contexts. This is a technical leadership role with no direct reports. You lead through the patterns you publish, the reviews you run and the engineers you coach and support.

The role is based at Boeing's head office at 123 Albert St, Brisbane CBD.

What you will do

Lead the embedding of secure software development

• Develop the secure software development processes and capabilities for the Program's software teams: threat modelling at design, secure coding standards, dependency and supply-chain controls, SAST, DAST and SBOM in the pipeline, code signing and security acceptance at release.
• Support and coach DevSecOps resources through the implementation of secure software development activities into DevSecOps pipelines.
• Coach software and DevSecOps engineers in threat modelling and secure design practices.
• Produce the evidence that system accreditation needs (ISM, DSPF) as a by-product of the pipeline, not as a separate exercise.

Design security architectures and patterns

• Write and maintain the reference security patterns engineering teams: identity and access for services, secrets handling, cross-domain and classified data flows, logging for investigation, secure update and configuration.
• Review system and software architectures at design review.
• Translate ISM, Essential Eight (E8) and DSPF controls into engineering patterns, so the control is met by the design.

Advise on security of LLMs

• For development: set the rules for LLM coding assistants and agents in the toolchain in accordance with frameworks such as the ISM and NIST.
• For autonomy: provide advice to MQ-28 systems and missionization teams on security of AI and ML components in the platform and its ground system. Threat modelling for model inputs and outputs, integrity of models and training data, adversarial input and model supply chain.
• Build the test approach for AI components: prompt injection and tool-abuse testing for agents, robustness and integrity testing for autonomy models, and the evidence an IRAP assessor will accept.
• Be the program's reference on the latest AI security guidance (ASD, NIST, allied partners).

About You

To be successful in this role, you will have:

• A Tertiary degree qualification in an engineering or related technical discipline.
• Demonstrated experience in applying relevant engineering practices, standards and regulations throughout the development lifecycle.
• Hands-on with a modern pipeline: you have incorporated SAST, dependency scanning and SBOM generation into CI and tuned them for performance.
• Security architecture experience across identity, secrets, logging and data flows, in a regulated environment (e.g. Defence, aerospace, critical infrastructure or finance).
• Working knowledge of LLM security: prompt injection, tool-use risk, agent permission models, model and data supply chain. You have deployed or secured at least one LLM-backed tool in a real environment.
• Ability to translate ISM controls into engineering requirements.
• Superb communication skills and the ability to collaborate, educate and influence within a multi-discipline team.
• Australian citizenship to meet Defence security requirements.
• Experience with AI or ML in safety-related or autonomous systems: model integrity, adversarial robustness, assurance arguments.
• Familiarity with DSPF, DISP, ISM and/or NIST and the accreditation process for classified systems.
• Experience in C, C++, Rust or Ada toolchains and embedded or real-time software.
• A security certification relevant to the role (CompTIA+, CISSP, CISM, SSCP, software security, or equivalent).
• Defence industry and/or government security experience.
• NV1 clearance (or higher).

What's on offer?

Boeing values the health and wellbeing of our employees and offer true flexibility including working from home, compressed work weeks, and opportunities for part time arrangements, allowing you to balance your career with what is important to you outside of work.

Other benefits:

• Work on cutting edge projects with opportunities to work across platforms.
• Attractive remuneration and annual bonus.
• Formal mentoring and training as well as on the job learning.
• Formal reward and recognition program.
• Access discounts for health insurance, travel and accommodation.
• Paid study leave, paid parental leave and Defence leave.
• Salary packaging options available.
• Health and wellbeing benefits including annual flu vaccinations and Employee Assistance Program.
• Social and community groups.

BDA works with strong links with our global Boeing community and we strongly encourage collaboration with our international counterparts.

We are committed to building a diverse and inclusive workplace. Female applicants, people of Aboriginal or Torres Strait Island descent and veterans are encouraged to apply.