Senior Application Security Engineer

Whizdom; Sydney; On-site; AUD 140,000 - 190,000; Full time

Job summary

Whizdom is seeking a Senior Application Security Engineer to lead the implementation and adoption of secure code-scanning capabilities across a complex software development environment.

You will integrate automated security testing into source-control systems and CI/CD pipelines, partnering with development, DevOps and security teams to establish remediation workflows and governance. You will mentor teams and promote secure coding practices.

Qualifications

• Demonstrated experience implementing Application Security or Secure Code Scanning solutions within large enterprise environments.
• Strong hands-on experience with one or more platforms such as Snyk, Fortify, Checkmarx or Veracode.
• Strong knowledge of Static Application Security Testing (SAST) and vulnerability-management practices.
• Experience integrating security tools with GitHub, GitLab and CI/CD pipelines.

Responsibilities

• Lead the implementation and onboarding of Secure Code Scanning platforms across complex software environments.
• Integrate security scanning with source-control systems and CI/CD pipelines.
• Establish scanning strategies, remediation workflows, quality gates and vulnerability-management processes.
• Mentor development teams and promote secure coding and DevSecOps best practices.

Skills

Application Security

SAST

DevSecOps

Secure SDLC

Security tooling

Stakeholder engagement

Tools

Snyk

Fortify

Checkmarx

Veracode

GitHub

GitLab

CI/CD pipelines

Job description

We are partnering with a leading enterprise organisation to engage an experienced Senior Application Security Engineer to lead the implementation and adoption of secure code-scanning capabilities across a complex software development environment.

This opportunity will suit a hands-on Application Security professional with strong experience implementing enterprise security platforms and embedding secure coding controls throughout the software development lifecycle.

About the Role

You will lead the implementation and onboarding of a Secure Code Scanning platform, integrating automated security testing into source-control systems and CI/CD pipelines.

Working closely with development, DevOps and security teams, you will establish scanning strategies, remediation workflows, quality gates and vulnerability-management processes. You will also support implementation, testing, rollout and post-go-live stabilisation while helping development teams adopt secure coding practices.

Key Responsibilities

• Lead the implementation and onboarding of Secure Code Scanning platforms such as Snyk, Fortify, Checkmarx or Veracode.
• Integrate security-scanning capabilities with GitHub, GitLab and CI/CD pipelines.
• Establish automated scanning, policy enforcement and secure coding controls across the software development lifecycle.
• Collaborate with development, DevOps and security teams to define scanning strategies and remediation workflows.
• Implement quality gates, exception-handling processes and vulnerability-remediation SLAs.
• Establish vulnerability triage, risk-prioritisation and remediation-tracking processes.
• Identify integration dependencies, developer-adoption challenges and potential performance impacts.
• Develop technical standards, deployment procedures, operational runbooks and governance processes.
• Provide hands-on support throughout implementation, testing, rollout and post-go-live stabilisation.
• Mentor development teams and promote secure coding and DevSecOps best practices.

Skills & Experience

To be successful in this role, you will have:

• Demonstrated experience implementing Application Security or Secure Code Scanning solutions within large enterprise environments.
• Strong hands-on experience with one or more platforms such as Snyk, Fortify, Checkmarx or Veracode.
• Strong knowledge of Static Application Security Testing (SAST) and vulnerability-management practices.
• Experience integrating security tools with GitHub, GitLab and CI/CD pipelines.
• Sound understanding of secure software development lifecycle principles and DevSecOps practices.
• Experience establishing vulnerability triage, risk-prioritisation and remediation processes.
• Ability to identify implementation risks, integration dependencies and developer-adoption challenges.
• Experience producing technical standards, deployment documentation, runbooks and governance processes.
• Strong stakeholder engagement skills and the ability to collaborate across development, DevOps and security teams.
• The ability to mentor technical teams and promote practical secure coding practices.

If you are an experienced Application Security Engineer with a strong background in Secure Code Scanning, SAST and DevSecOps implementation, we’d love to hear from you

Candidates will need to be willing to undergo pre-employment screening checks, which may include identity and work rights checks, security clearance verification and any other client-requested checks