Security Engineer

Creditorwatch; Sydney; Hybrid; AUD 120,000 - 180,000; Full time

Job summary

CreditorWatch is building a dedicated Security Engineering function to actively operate, tune, and integrate security across enterprise and product domains. The Security Engineer will balance IAM, Zero Trust, DLP, SSE, EDR with application security, vulnerability management, and SDLC hardening.

The role spans employee endpoints, SaaS platforms, CI/CD pipelines, cloud infrastructure, and the application layer, reporting to the Principal Product Security Engineer in a hybrid Sydney CBD setting.

Qualifications

• Hands-on experience across multiple security domains as a generalist.
• Experience in app security practices: code review, SAST/SCA, threat modelling.
• Cloud security knowledge with AWS familiarity.
• Ability to embed security into CI/CD and work with engineering teams.
• Strong scripting and automation capability; effective communicator.

Responsibilities

• Improve security posture across SaaS platforms and endpoints.
• Tune and operate enterprise security tools (EDR, SSE, DLP, IAM).
• Drive threat detection, runbooks, and security alert workflows.
• Perform security reviews, threat modelling, and risk assessments.
• Embed security controls in CI/CD pipelines and secure software supply chain.
• Collaborate with Engineering and mentor security champions.
• Support ISO 27001, SOC 2 compliance activities where relevant.

Skills

Generalist security

Application security

Threat modelling

Vulnerability management

Cloud security (AWS)

CI/CD security

IAM & SSO concepts

Scripting (Python/Bash)

Communication

Security tooling knowledge

Tools

Security Hub

Inspector

GuardDuty

SSE/SWG

DLP

EDR

Job description

Who are we

CreditorWatch is a leading Australian data and technology company that provides businesses with access to unique data and innovative products. Our platform helps customers confidently manage commercial relationships, improve productivity and reduce financial risk.

As a commercial credit reporting bureau, we offer a complete suite of credit reporting products and data insights covering the entire customer lifecycle—from customer onboarding and credit decision automation to credit risk management and automated collections.

Established in 2010, we have been named one of AFR's Top 10 Best Places to Work and certified by Great Place to Work consecutively across 2022–2025. We are scaling at pace, making this an exciting time to join CreditorWatch.

Our Purpose

Empower Australian businesses to trade confidently with their customers.

Our Mission

We aim to be number one in our industry by delivering unique data insights and innovative products.

Your Role & Team

We are establishing a dedicated Security Engineering function to ensure we are not just purchasing security platforms, but actively operating, tuning, and integrating them effectively.

We are looking for a Security Engineer to join this newly created team. This is a hands-on, generalist role spanning both enterprise/internal security (IAM, Zero Trust, DLP, SSE, EDR) and product security (application security, vulnerability management, SDLC hardening, security reviews). You will split your time across both domains—helping to protect our corporate environment while embedding security into the way our engineering teams build and deliver software.

You will work across the full stack—from employee endpoints and SaaS platforms through to CI/CD pipelines, cloud infrastructure, and the application layer. You will act as a trusted partner to Engineering, a technical resource for the broader business, and a key contributor to maintaining the security posture expected of an Australian credit bureau handling sensitive financial data.

You will report to the Principal Product Security Engineer. This is a full-time role with hybrid working conditions based out of our Sydney CBD office.

Responsibilities

Enterprise & Internal Security

• Improve the security posture across SaaS platforms, employee endpoints, and office networks.
• Implement, tune, and operate enterprise security solutions including SSE, EDR, DLP, Email Security, and IAM.
• Enhance threat detection and response capabilities, contribute to operational runbooks, and own security alert workflows.

Product & Application Security

• Strengthen the security posture of our platform and SDLC through security reviews, threat models, and risk-based assessments.
• Identify vulnerabilities and provide practical remediation strategies aligned to business impact.
• Embed and operationalise security controls within CI/CD pipelines (SAST, SCA, secrets detection) with clear ownership, SLAs, and automated feedback loops.
• Drive initiatives to harden the software supply chain and CI/CD infrastructure, enabling secure development and deployment practices.

Cross Organisation

• Act as a trusted advisor to Engineering, providing guidance on secure development practices across CreditorWatch products and services.
• Contribute to frameworks, guidance and tooling that enable engineers to safely adopt AI/ML capabilities in software development.
• Mentor engineers and security champions to uplift security awareness and foster a proactive security culture.
• Contribute to vulnerability management processes, ensuring findings are tracked, prioritised, and remediated in line with risk tolerance and SLOs.
• Provide domain expertise in security-related incident response processes.
• Support compliance and assurance activities (ISO 27001, SOC 2) where they intersect with engineering controls and evidence.

Our ideal candidate

• Demonstrated hands-on experience across multiple security domains, capable of operating as a broad generalist.
• Experience with application security practices, including secure code review, SAST/SCA tooling, threat modelling, and vulnerability management in cloud-native or SaaS environments.
• Working knowledge of cloud security (preferably AWS), including IAM, networking, and services such as Security Hub, Inspector, or GuardDuty.
• Experience embedding security into CI/CD pipelines and working closely with engineering teams to shift security left without impacting delivery.
• Familiarity with enterprise security tools such as EDR, SSE/SWG, DLP, email security, and ASPM platforms.
• Strong understanding of identity and access management concepts, including SSO (OAuth, OIDC, SAML), conditional access, and least privilege.
• Exposure to relevant compliance frameworks (e.g. ISO 27001, SOC 2, OWASP Top 10).
• Ability to script or automate workflows using tools such as Python, Bash, or APIs.
• Strong communication skills, with the ability to translate security findings into practical guidance for engineers and articulate risk to non-technical stakeholders.
• A genuine interest in working across a broad range of security domains and context-switching as required.