Security Engineer (Application Security)Hybrid

Flybuys; City of Melbourne; Hybrid; AUD 120,000 - 170,000; Full time

Benefits offered by this job

Flybuysflex

Two well-being days

Volunteer leave

Learning & development programs

Discount card

Be Well Programs

Quarterly All Team events

Hybrid social events

New starter kit merchandise

Job summary

Flybuys is seeking a Security Engineer (Application Security) to embed security into software from build to deployment. You’ll partner with engineering squads to implement secure coding practices, run security tooling, and continuously improve cloud and application security postures.

You’ll work within the Cyber Security team to deliver practical security solutions, supported by a senior engineer, with room to learn and grow in a fast-paced environment.

Qualifications

• Hands-on security engineering and DevSecOps experience.
• Experience with CI/CD pipelines and tool integration.
• Knowledge of AWS basics and IAM, networking, compute, and native security services.
• Experience with at least one security tool (SAST/DAST/SCA/IaC scanning) and OWASP Top 10.
• Interest in AI/ML tools and LLMs applied to security.
• Strong communication to explain findings to developers.
• Desirable: CNAPP, GitLab, container/API security concepts.
• Relevant certifications or active pursuit encouraged.

Responsibilities

• Implement and maintain security scanning tools in GitLab CI/CD pipelines.
• Tune scanners to reduce false positives and improve feedback.
• Build quality gates giving fast, actionable security feedback.
• Extend security-as-code artefacts across repositories.
• Assist remediation of findings surfaced by tooling.
• Prioritise vulnerability findings from Wiz, AWS Inspector, Defender, SAST, DAST.
• Correlate findings with asset context and business criticality.
• Track remediation progress within SLAs.
• Contribute to vulnerability reporting, dashboards, metrics.
• Identify recurring issues and recommend systemic fixes.
• Assist in security guardrails across AWS.
• Review Infrastructure-as-Code for misconfigurations.
• Participate in threat modelling and security-focused code reviews.
• Support pentest coordination, scoping, retest.
• Build scripts, integrations, lightweight tools to automate tasks.
• Assist with AI/ML-assisted workflows and LLM tooling.

Skills

CI/CD pipelines

AWS basics

Application security tools

OWASP Top 10

AI/ML security

Technical communication

GitLab/CNAPP

Threat modelling

Security certifications

2-4 years experience

Tools

SAST

DAST

SCA

IaC scanning

Container image scanning

Secrets detection

GitLab

API security concepts

Job description

Security Engineer (Application Security)Hybrid

We’re known for being the country’s most popular rewards program, helping over 10 million Australians get more of what they value beyond the checkout. And through our extended network of partnerships with other nationally recognised brands, we make every day simpler, easier and more rewarding for our members. Plus, we’re also the winner of Canstar Blue's 2023, 2024 and 2025 Most Satisfied Customer award for Rewards Programs

But,we'remore than the card you carry around in your wallet or the app on your phone!Our diverse team islocatedall over Australia, and our incredible office islocatedright in the heart of Melbourne CBD.Staying true to our flexible working policy and people-centric culture, we ensure all our team members are set up to work remotely across Australia. We are outcomes-focused, and everything we do is aligned with our core principles - Own, Act and Inspire.

Your Team

We've already built a pretty amazing team, but we're not looking for more of the same. Our day-to-day is made stronger when we surround ourselves with people who are different, like you.

Your Role

The Security Engineer (Application Security) is a hands‑on technical role that blends application security, DevSecOps, and cloud security. The role works alongside engineering teams to embed security into how software is built, deployed, and operated across Flybuys' technology estate. This role suits someone with a strong engineering foundation who is ready to grow deeper into application and cloud security, while contributing meaningfully from day one.

The role sits within the Cyber Security team and works closely with Application Development, Cloud, and Data teams. It is designed to be a practical, approachable security partner to engineering squads, supported by a senior security engineer and given room to learn, build, and grow.

Key Areas of Accountability

• Implement and maintain security scanning tools within GitLab CI/CD pipelines.
• Tune scanners to reduce false positives and improve the developer feedback experience.
• Help build quality gates that give developers fast, actionable security feedback without unnecessary friction.
• Maintain and extend security-as-code artefacts across repositories.
• Support engineering teams in understanding and remediating findings surfaced by pipeline tooling.
• Triage and prioritise vulnerability findings from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate findings with asset context, including internet exposure, data sensitivity, and business criticality.
• Track remediation progress and support engineering teams in fixing issues within SLA.
• Contribute to vulnerability reporting, dashboards, and metrics that help the team make better decisions.
• Identify patterns and recurring issues and recommend systemic fixes.
• Assist in implementing and maintaining security guardrails across AWS.
• Review Infrastructure-as-Code for security misconfigurations.
• Participate in threat modelling sessions and perform security-focused code reviews.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Build scripts, integrations, and lightweight tools to automate repetitive security tasks.
• Assist with AI/ML-assisted workflows and LLM-based tooling for security use cases

Your Experience

• 2-4 years in security engineering, DevSecOps, software engineering, or platform/infrastructure roles with demonstrated security interest.
• Hands‑on experience with CI/CD pipelines, including configuring, troubleshooting, and integrating tools into automated delivery workflows.
• Working knowledge of AWS, including IAM basics, networking fundamentals, compute services, and native security services.
• Experience with at least one application security tool, such as SAST, DAST, SCA, IaC scanning, container image scanning, or secrets detection.
• Understanding of OWASP Top 10 and common web application vulnerabilities.
• Interest in and early experience with AI/ML tools or LLMs applied to engineering or security tasks.
• Good communication skills, with the ability to clearly explain findings and recommendations to developers.
• Experience with CNAPP platforms, GitLab, container security, or API security concepts (desirable)
• Exposure to threat modelling, AI/ML security risks, or secure use of LLM-based tooling (desirable)
• Relevant certifications or active pursuit of them (desirable)

We offer our valued team members a stack of exclusive benefits! To name a few...

• Flybuysflex | work from anywhere, measured on outcomes
• Two well-being days per year!
• Volunteer leave
• Ongoing learning & development programs and opportunities
• My Coles and Wesfarmers team member discount card
• Be Well Programs – Mind/Body/Soul
• Quarterly All Team events
• Hybrid social events
• New starter kit merchandise

We value ways of working that work for everyone and use our different strengths to make us stronger. We work hard to make sure everyone’s voice is heard and respected equally, regardless of identity, background, position, ability or lifestyle.

It is a condition of employment that successful applicants undergo a National Police Check prior to commencing.

Be careful - Don’t provide your bank or credit card details when applying for jobs. Don't transfer any money or complete suspicious online surveys. If you see something suspicious, report this job ad .