Senior Security Architect: Identity & App Security

Ubank; Sydney; Hybrid; AUD 180,000 - 250,000; Full time

Benefits offered by this job

Hybrid working model

Competitive benefits

Career development

Job summary

Ubank, a Sydney-based digital bank, seeks a Senior Principal Security Engineer (Application & Identity) to lead security architecture across customer-facing products. You will design reusable patterns, drive identity strategy, and govern secure integrations with third parties in a cloud-native environment.

The role partners with product squads to embed security, advance phishing-resistant identity standards, and enforce least‑privilege across microservices. A hybrid work model is supported.

Qualifications

• 10+ years of hands-on security engineering experience, with at least 4 years focused on application security, identity architecture, or authentication platforms in complex distributed systems.
• Demonstrated experience designing and implementing production identity systems – customer-facing authentication, service mesh authorisation, certificate lifecycle management, or API security at scale.
• Proven track record of creating reusable security patterns, libraries, or frameworks that engineering teams adopted to eliminate recurring vulnerability classes without requiring ongoing consultation.
• At least 3 years operating in environments with significant third‑party integration complexity – payment processors, data providers, or financial services partners requiring mTLS, OAuth federation, or certificate-based trust.
• Experience in a regulated financial services, fintech, or payments environment (APRA, PRA, FCA, OCC, or equivalent) is highly desirable.

Responsibilities

• Design and build production security patterns, middleware, and reference implementations that make secure defaults the path of least resistance for product squads.
• Define binding security architecture decisions for authentication flows, service authorization, and third‑party integrations – with clear escalation paths where trade‑offs exist.
• Build and maintain reusable threat models, security building blocks, and integration patterns that reduce time‑to‑production for new features and partnerships.
• Lead the technical strategy for customer authentication and credential lifecycle – evolving toward phishing‑resistant, modern identity standards.
• Design service‑to‑service authorisation architecture ensuring least‑privilege, auditability, and resilience across the microservices landscape.
• Establish certificate management, mTLS, and API security patterns for external partner and payment‑rail integrations.
• Partner directly with product tribes during design and delivery – providing security architecture guidance as an embedded engineering collaborator, not an external gate.
• Coach and enable squads to conduct threat modelling and apply security patterns independently, scaling security decision‑making beyond the security team.
• Build and curate a living security pattern library covering identity, integration, and data protection – ensuring patterns stay current as the threat landscape evolves.
• Define quality gates for security patterns, measuring adoption, effectiveness, and coverage across the engineering organisation.
• Ensure the identity architecture is continuously hardened through automated validation, least‑privilege reviews, and proactive elimination of privilege escalation paths.
• Lead security incident response for application and identity domains – conducting root cause analysis and translating findings into preventive engineering controls
• Ensure application security and identity controls satisfy APRA CPS 234 obligations through engineering implementation rather than compliance documentation alone.
• Provide technical evidence and architectural artefacts that demonstrate control effectiveness to internal and external audit functions.

Skills

Security engineering

Application security

Identity architecture

Authentication platforms

Threat modelling

Security patterns

mTLS

OAuth federation

Tools

OIDC

SAML

FIDO2

OAuth federation

Job description

Ubank, a Sydney-based digital bank, seeks a Senior Principal Security Engineer (Application & Identity) to lead security architecture across customer-facing products. You will design reusable patterns, drive identity strategy, and govern secure integrations with third parties in a cloud-native environment.

The role partners with product squads to embed security, advance phishing-resistant identity standards, and enforce least‑privilege across microservices. A hybrid work model is supported.