Senior Application Security Engineer – AI Cloud

Firmus Technologies; Sydney; On-site; AUD 170,000 - 230,000; Full time

Job summary

Firmus Technologies, a global AI infra leader founded in Australia, seeks a Senior Security Engineer to own application security for Firmus AI Cloud and internal software. You will secure public APIs, tenant isolation, and the control plane with an automation-first mindset.

You will lead threat modelling, security design reviews, and enforce SOC 2 Type 2/ISO 27001 controls as the platform scales. Strong English communication is essential.

Qualifications

• Bachelor's degree in computer science or a related technical field.
• 7+ years in application security, product security, or software engineering with a security focus.
• Experience securing a public cloud or multi-tenant platform with a public API.
• Deep knowledge of OWASP Top 10 and OWASP API Security Top 10; threat modelling multi-tenant APIs.
• Improved security posture of software through standards, tooling, or secure-by-default patterns.
• Owned CI/CD security gates (SAST, DAST, SCA, secrets detection, SBOM).
• Writes production-quality code in Python, Go, or TypeScript.
• Hands-on with LLM-backed or agentic features and OWASP guidance for AI security.

Responsibilities

• Own the CI/CD security gates across production repositories (SAST, DAST, SCA, secrets).
• Build repeatable security triage, dependency uplift, evidence collection, threat models.
• Ship secure libraries, service templates, and developer tooling for teams.
• Write and review security-critical code paths in services.

Skills

Application security

Cloud security

Threat modelling

CI/CD security

Programming (Python/Go/TS)

Incident response

Security automation

English communication

Education

Bachelor's degree in computer science or related field

Tools

SAST

DAST

SCA

SBOM

OAuth/OIDC/JWT tooling

Job description

Firmus Technologies, a global AI infra leader founded in Australia, seeks a Senior Security Engineer to own application security for Firmus AI Cloud and internal software. You will secure public APIs, tenant isolation, and the control plane with an automation-first mindset.

You will lead threat modelling, security design reviews, and enforce SOC 2 Type 2/ISO 27001 controls as the platform scales. Strong English communication is essential.