Product Security Engineer (Secure Software)

BOEING; Brisbane; Hybrid; AUD 180,000 - 230,000; Full time

Benefits offered by this job

Working from home

Annual bonus

Mentoring and training

Salary packaging options

Defence leave

Job summary

Boeing Defence Australia (BDA) is recruiting a senior System Security Technical Lead in Brisbane to embed secure software development across the MQ-28 program. You will architect secure patterns and guide engineering teams, including AI/ML security in safety-critical contexts, with no direct reports but technical leadership through reviews, coaching and published patterns.

The role requires extensive experience in secure software development, threat modelling, and ISM/NIST/NIST frameworks, and

Qualifications

• Tertiary degree qualification in an engineering or related technical discipline.
• Experience applying engineering practices, standards and regulations throughout the development lifecycle.
• Hands-on with a modern pipeline: SAST, dependency scanning and SBOM generation.
• Security architecture across identity, secrets, logging and data flows in regulated environments.
• Knowledge of LLM security: prompt injection, tool-use risk, models and data supply chain.

Responsibilities

• Lead embedding of secure software development.
• Develop secure software development processes for the program's software teams: threat modelling at design, secure coding standards, dependency and supply-chain controls, SAST/DAST/SBOM, code signing and secure release acceptance.
• Coach DevSecOps resources in threat modelling and secure design practices.
• Translate ISM/Essential Eight into engineering patterns for design compliance.
• Advise on security of LLMs for development and autonomy contexts.

Skills

Threat modelling

Security architecture

DevSecOps

Coaching

Communication

ISM/NIST frameworks

AI security

Education

Engineering degree

Tools

C/C++ toolchains

Rust

Ada

CI/CD pipelines

Job description

About UsDo you aspire to help build something better? Would you like to work for a company that employs the best talent to develop and deliver world class capabilities and systems to protect Australia and its national interests? Would you like to work on cutting edge projects? Then we would like to talk to you.As an equal opportunity employer that promotes a diverse and safe workplace environment, one of the country's leading and preferred defence partners, Boeing Defence Australia (BDA) is now recruiting a System Security Technical Lead in Brisbane to support the MQ-28 Program.The OpportunityWe are seeking a senior product security engineer to lead the implementation and embedding of secure software development practices on the MQ-28 program. You will lead the development of architecture patterns that engineering teams will use. You will also lead the development and implementation of LLM security in a development toolchains and in mission autonomy applications.The successful candidate will have comprehensive awareness and practical experience applying product security engineering design practices, experience embedded secure software development practices, and experience with AI or ML in safety-related or autonomous systems contexts. This is a technical leadership role with no direct reports. You lead through the patterns you publish, the reviews you run and the engineers you coach and support.The role is based at Boeing's head office at 123 Albert St, Brisbane CBD.What you will doLead the embedding of secure software developmentDevelop the secure software development processes and capabilities for the Program's software teams: threat modelling at design, secure coding standards, dependency and supply-chain controls, SAST, DAST and SBOM in the pipeline, code signing and security acceptance at release.Support and coach DevSecOps resources through the implementation of secure software development activities into DevSecOps pipelines.Coach software and DevSecOps engineers in threat modelling and secure design practices.Produce the evidence that system accreditation needs (ISM, DSPF) as a by-product of the pipeline, not as a separate exercise.Design security architectures and patternsWrite and maintain the reference security patterns engineering teams: identity and access for services, secrets handling, cross-domain and classified data flows, logging for investigation, secure update and configuration.Review system and software architectures at design review.Translate ISM, Essential Eight (E8) and DSPF controls into engineering patterns, so the control is met by the design.Advise on security of LLMsFor development: set the rules for LLM coding assistants and agents in the toolchain in accordance with frameworks such as the ISM and NIST.For autonomy: provide advice to MQ-28 systems and missionization teams on security of AI and ML components in the platform and its ground system. Threat modelling for model inputs and outputs, integrity of models and training data, adversarial input and model supply chain.Build the test approach for AI components: prompt injection and tool-abuse testing for agents, robustness and integrity testing for autonomy models, and the evidence an IRAP assessor will accept.Be the program's reference on the latest AI security guidance (ASD, NIST, allied partners).About YouTo be successful in this role, you will have:A Tertiary degree qualification in an engineering or related technical discipline.Demonstrated experience in applying relevant engineering practices, standards and regulations throughout the development lifecycle.Hands-on with a modern pipeline: you have incorporated SAST, dependency scanning and SBOM generation into CI and tuned them for performance.Security architecture experience across identity, secrets, logging and data flows, in a regulated environment (e.g. Defence, aerospace, critical infrastructure or finance).Working knowledge of LLM security: prompt injection, tool-use risk, agent permission models, model and data supply chain. You have deployed or secured at least one LLM-backed tool in a real environment.Ability to translate ISM controls into engineering requirements.Superb communication skills and the ability to collaborate, educate and influence within a multi-discipline team.Australian citizenship to meet Defence security requirements.DesirableExperience with AI or ML in safety-related or autonomous systems: model integrity, adversarial robustness, assurance arguments.Familiarity with DSPF, DISP, ISM and/or NIST and the accreditation process for classified systems.Experience in C, C++, Rust or Ada toolchains and embedded or real-time software.A security certification relevant to the role (CompTIA+, CISSP, CISM, SSCP, software security, or equivalent).Defence industry and/or government security experience.NV1 clearance (or higher).What's on offer?Boeing values the health and wellbeing of our employees and offer true flexibility including working from home, compressed work weeks, and opportunities for part time arrangements, allowing you to balance your career with what is important to you outside of work.Other benefits:Work on cutting edge projects with opportunities to work across platforms.Attractive remuneration and annual bonus.Formal mentoring and training as well as on the job learning.Formal reward and recognition program.Access discounts for health insurance, travel and accommodation.Paid study leave, paid parental leave and Defence leave.Salary packaging options available.Health and wellbeing benefits including annual flu vaccinations and Employee Assistance Program.Social and community groups.BDA works with strong links with our global Boeing community and we strongly encourage collaboration with our international counterparts.We are committed to building a diverse and inclusive workplace. Female applicants, people of Aboriginal or Torres Strait Island descent and veterans are encouraged to apply.