Security Engineer (AppSec / Cloud)

CH Solutions; Melbourne; Hybrid; AUD 120,000 - 160,000; Full time

Job summary

CH Solutions in Melbourne is seeking an experienced security engineer to remediate vulnerabilities, embed security into CI/CD, and secure AWS cloud environments. You’ll work with a Security Analyst and Compliance Analyst, reporting to the CISO, delivering practical security improvements across multiple domains.

You’ll perform threat assessments, support ISO 27001, audits and penetration testing, and partner with delivery teams to provide pragmatic security guidance. Hybrid working is offered.

Qualifications

• Hands-on security engineering experience fixing vulnerabilities including OWASP Top 10.
• Comfort working with application code and able to identify and fix issues.
• Solid understanding of OWASP Top 10 and secure coding practices.
• Cloud security experience with AWS preferred.
• Scripting or automation skills (e.g., Python, PowerShell, Bash).
• Experience with CI/CD, Infrastructure as Code and DevSecOps practices.
• Exposure to SIEM, SOC/MSSP collaboration and incident response.
• Clear communication with technical and non-technical stakeholders.

Responsibilities

• Remediate vulnerabilities hands-on, including OWASP Top 10, collaborating with application teams.
• Embed security into CI/CD pipelines and Infrastructure as Code.
• Secure the cloud environment, primarily AWS.
• Collaborate with external SOC to investigate, prioritise and respond to alerts.
• Design, implement and improve controls across identity, endpoint, network, application and data security.
• Automate repeatable security tasks to reduce manual effort.
• Run security reviews, threat assessments and control testing for new solutions and changes.
• Support ISO 27001, audit and penetration testing activities.
• Provide practical, pragmatic security advice to delivery teams.

Skills

Security engineering

OWASP Top 10

AWS Cloud

Automation scripting

CI/CD

DevSecOps

SOC/SIEM experience

Stakeholder communication

Job description

The team

You’ll work alongside a Security Analyst, who handles triage and raises findings, and a Compliance Analyst, who manages audit and assurance. Your focus is engineering and remediation, reporting to the CISO.

What you’ll do

• Remediate application vulnerabilities hands-on, including broken access control and other OWASP Top 10 issues, working with application team leads
• Embed security into CI/CD pipelines and Infrastructure as Code
• Secure the cloud environment, primarily AWS
• Work with the external Security Operations Centre to investigate, prioritise and respond to alerts and incidents
• Design, implement and improve controls across identity, endpoint, network, application and data security
• Automate repeatable security tasks to reduce manual effort
• Run security reviews, threat assessments and control testing for new solutions and changes
• Support ISO 27001, audit and penetration testing activities
• Give practical, pragmatic security advice to delivery teams

What you’ll bring

• Hands-on security engineering experience, with real examples of vulnerabilities you’ve fixed yourself
• Comfort working in application code: you don’t need to be a developer, but you can find the problem and fix it
• Solid understanding of the OWASP Top 10 and secure coding practices
• Cloud security experience, with AWS highly regarded
• Scripting or automation skills (for example Python, PowerShell or Bash)
• Experience with CI/CD, Infrastructure as Code and DevSecOps practices
• Exposure to SIEM, SOC/MSSP collaboration and incident response
• Clear communication with both technical and non-technical stakeholders

Desirable

a security certification such as Security+, SSCP, GSEC or CISSP

Why you’ll love it

• Genuine ownership and autonomy: you’re the fixer, not the ticket-raiser
• Broad, modern work across application security, cloud and DevSecOps
• Work that matters to an organisation trusted by the community
• Hybrid working in a supportive, collaborative team

Background checks apply, and the role may include occasional out-of-hours work.

Be careful - Don’t provide your bank or credit card details when applying for jobs. Don't transfer any money or complete suspicious online surveys. If you see something suspicious, report this job ad .