Security Engineer (Application Security) - Hybrid

Flybuys; Melbourne; Hybrid; AUD 120,000 - 180,000; Full time

Benefits offered by this job

Well-being days

Volunteer leave

Learning & development

Team discounts

Hybrid work policy

New starter kit merchandise

Job summary

Flybuys in Melbourne is seeking a hands-on Security Engineer (Application Security) to blend security into how software is built, deployed and operated across our technology estate. You’ll work with engineering squads in a practical, security-focused partner role within the Cyber Security team, contributing from day one and growing your expertise in cloud security and DevSecOps.

It’s a hands-on role with opportunities to influence vulnerability management, threat modelling and secure coding

Qualifications

• 2–4 years in security engineering, DevSecOps, or related roles with security focus.

Responsibilities

• Implement and maintain security scanning tools in pipelines.
• Tune scanners to reduce false positives and improve feedback.
• Build security gates for fast actionable feedback.
• Maintain security-as-code artefacts across repos.
• Support engineering in remediation of findings.
• Triage vulnerabilities from Wiz, AWS Inspector, Defender, SAST/DAST.
• Correlate findings with asset context and business criticality.
• Track remediation progress within SLAs.
• Contribute to vulnerability reporting and dashboards.
• Identify patterns and recommend systemic fixes.
• Review Infrastructure-as-Code for security misconfigurations.
• Participate in threat modelling and security-focused code reviews.
• Assist in penetration testing coordination.
• Build scripts and lightweight tools to automate tasks.
• Assist with AI/ML-assisted workflows and LLM tooling for security use cases.

Skills

CI/CD pipelines

AWS basics

Application security tools

OWASP Top 10

AI/ML security

Security communication

CNAPP/GitLab

Threat modelling

Tools

GitLab

Container security

API security concepts

IaC scanning

Secrets detection

Job description

About Us

We’re known for being the country’s most popular rewards program, helping over 10 million Australians get more of what they value beyond the checkout. And through our extended network of partnerships with other nationally recognised brands, we make every day simpler, easier and more rewarding for our members. Plus, we’re also the winner of Canstar Blue's 2023, 2024 and 2025 Most Satisfied Customer award for Rewards Programs

But,we'remore than the card you carry around in your wallet or the app on your phone!Our diverse team islocatedall over Australia, and our incredible office islocatedright in the heart of Melbourne CBD.Staying true to our flexible working policy and people-centric culture, we ensure all our team members are set up to work remotely across Australia. We are outcomes-focused, and everything we do is aligned with our core principles - Own, Act and Inspire.

Your Team

We've already built a pretty amazing team, but we're not looking for more of the same. Our day-to-day is made stronger when we surround ourselves with people who are different, like you.

Your Role

The Security Engineer (Application Security) is a hands-on technical role that blends application security, DevSecOps, and cloud security. The role works alongside engineering teams to embed security into how software is built, deployed, and operated across Flybuys' technology estate. This role suits someone with a strong engineering foundation who is ready to grow deeper into application and cloud security, while contributing meaningfully from day one.

The role sits within the Cyber Security team and works closely with Application Development, Cloud, and Data teams. It is designed to be a practical, approachable security partner to engineering squads, supported by a senior security engineer and given room to learn, build, and grow.

Key Areas of Accountability

• Implement and maintain security scanning tools within GitLab CI/CD pipelines.
• Tune scanners to reduce false positives and improve the developer feedback experience.
• Help build quality gates that give developers fast, actionable security feedback without unnecessary friction.
• Maintain and extend security-as-code artefacts across repositories.
• Support engineering teams in understanding and remediating findings surfaced by pipeline tooling.
• Triage and prioritise vulnerability findings from sources such as Wiz, AWS Inspector, Defender, SAST, and DAST tools.
• Correlate findings with asset context, including internet exposure, data sensitivity, and business criticality.
• Track remediation progress and support engineering teams in fixing issues within SLA.
• Contribute to vulnerability reporting, dashboards, and metrics that help the team make better decisions.
• Identify patterns and recurring issues and recommend systemic fixes.
• Assist in implementing and maintaining security guardrails across AWS.
• Review Infrastructure-as-Code for security misconfigurations.
• Participate in threat modelling sessions and perform security-focused code reviews.
• Support penetration testing coordination, including scoping, remediation tracking, and retest validation.
• Build scripts, integrations, and lightweight tools to automate repetitive security tasks.
• Assist with AI/ML-assisted workflows and LLM-based tooling for security use cases

Your Experience

• 2-4 years in security engineering, DevSecOps, software engineering, or platform/infrastructure roles with demonstrated security interest.
• Hands-on experience with CI/CD pipelines, including configuring, troubleshooting, and integrating tools into automated delivery workflows.
• Working knowledge of AWS, including IAM basics, networking fundamentals, compute services, and native security services.
• Experience with at least one application security tool, such as SAST, DAST, SCA, IaC scanning, container image scanning, or secrets detection.
• Understanding of OWASP Top 10 and common web application vulnerabilities.
• Interest in and early experience with AI/ML tools or LLMs applied to engineering or security tasks.
• Good communication skills, with the ability to clearly explain findings and recommendations to developers.
• Experience with CNAPP platforms, GitLab, container security, or API security concepts (desirable)
• Exposure to threat modelling, AI/ML security risks, or secure use of LLM-based tooling (desirable)
• Relevant certifications or active pursuit of them (desirable)

Your Benefits!

We offer our valued team members a stack of exclusive benefits! To name a few...

• Flybuysflex | work from anywhere, measured on outcomes
• Two well-being days per year!
• Volunteer leave
• Ongoing learning & development programs and opportunities
• My Coles and Wesfarmers team member discount card
• Be Well Programs – Mind/Body/Soul
• Quarterly All Team events
• Hybrid social events
• New starter kit merchandise

Be You, With Us.

We value ways of working that work for everyone and use our different strengths to make us stronger. We work hard to make sure everyone’s voice is heard and respected equally, regardless of identity, background, position, ability or lifestyle.

It is a condition of employment that successful applicants undergo a National Police Check prior to commencing.