Senior Product Security Engineer - Hybrid (Sydney)

The Bitcoin Street Journal; Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

USD 500 WFH allowance

Internet/Phone stipend USD 600/yr

Remote work quarterly USD 75

Novated Leasing AUS

US medical and 401K insurance

Growth funding up to USD 1,350/yr

Udemy courses access

Health & wellbeing support USD 800/yr

Counselling via EAP (24/7)

ClassPass subsidy with 1-year weblink

Job summary

Immutable builds products for game studios and blockchain infrastructure, with a dedicated security team working across web apps, APIs, AWS, GCP and smart contracts. The Senior Security Engineer will help fix vulnerabilities before production and collaborate closely with product engineering teams.

You’ll own the vulnerability program, triage security findings, and evolve threat models as the platform grows, while also developing internal tooling and AI-based review capabilities.

Qualifications

• Security-focused software engineer with ability to ship production code.
• Experience reviewing services, building threat models and triaging vulnerabilities.

Responsibilities

• Own the vulnerability management program including Bugcrowd and Immunefi.
• Own AI agents that review pull requests for security issues and triage bugs.
• Maintain a security context layer for triage and fixes with limited human input.
• Keep threat models and attack graphs up to date as the product evolves.
• Identify and fix broken auth flows and injection bugs in code.
• Build AI tooling and internal security tools to streamline processes.
• Leverage AWS security experience; familiarity with GCP and web3 knowledge is a plus.

Job description

Immutable builds products for game studios and blockchain infrastructure, with a dedicated security team working across web apps, APIs, AWS, GCP and smart contracts. The Senior Security Engineer will help fix vulnerabilities before production and collaborate closely with product engineering teams.

You’ll own the vulnerability program, triage security findings, and evolve threat models as the platform grows, while also developing internal tooling and AI-based review capabilities.