Remote Information Security Engineer III — Cloud & AppSec

InComm Payments; City of Melbourne; On-site; AUD 150,000 - 190,000; Full time

Benefits offered by this job

Employee Referral Bonus Program

Job summary

InComm Payments is seeking an Information Security Engineer III in Melbourne to secure applications by integrating security tools into CI/CD pipelines and leading incident response. You will work with Azure, AWS, and OCI, perform threat modeling, and ensure compliance with OWASP and industry standards.

The role requires 5+ years in application security, strong scripting, and hands-on SAST/DAST expertise across multi-cloud environments.

Qualifications

• 5+ years of application security experience.
• CI/CD tooling such as Jenkins, GitHub Actions, Azure Pipelines.
• Scripting with PowerShell or Python.
• Experience with SAST & DAST tools and OWASP methodologies.
• Web/app security in cloud environments (Azure, AWS, OCI).

Responsibilities

• Integrate SAST tooling into CI/CD pipelines.
• Provide tailored SAST integration support for dev teams.
• Analyze application logs and communicate findings to leadership.
• Participate in on-call rotation for WAF incidents.
• Validate vulnerabilities and tune configurations to reduce false positives.
• Develop threat models with development teams.
• Assess security configurations in Azure, AWS, and OCI.
• Assist in incident response and remediation actions.
• Participate in design and architectural reviews.
• Coordinate with third parties for vulnerability testing.

Skills

CI/CD tooling

Scripting

SAST/DAST

OWASP

Penetration testing

Cloud security

WAF

IAM security

Collaboration

Multi-cloud

Tools

Jenkins

GitHub Actions

Azure Pipelines

Docker

Kubernetes

PowerShell

Python

Job description

InComm Payments is seeking an Information Security Engineer III in Melbourne to secure applications by integrating security tools into CI/CD pipelines and leading incident response. You will work with Azure, AWS, and OCI, perform threat modeling, and ensure compliance with OWASP and industry standards.

The role requires 5+ years in application security, strong scripting, and hands-on SAST/DAST expertise across multi-cloud environments.