Senior Security Engineer - App & Cloud (Remote AU)

DISCO; Melbourne; Remote; AUD 140,000 - 190,000; Full time

Benefits offered by this job

Competitive salary

Four weeks paid vacation

Paid parental leave

Company laptop

Internet allowance

Learning and development allowance

Job summary

DISCO is expanding its security program with a dedicated Security Engineer role focused on end-to-end security across applications, cloud, and incident response. You will drive secure design, threat modelling, and remediation across Python/Django/React stacks, with emphasis on AWS security and SOC 2 compliance.

You will collaborate with engineering, product, legal, and leadership while working remotely from Australia.

Qualifications

• 7+ years in engineering and 5+ years of hands-on security experience in a product security, application security, or security engineering role
• Experience with threat hunting, threat intelligence, or red team activities
• Strong Python/Django application security knowledge - you know how web vulnerabilities present in this stack and how to fix them, not just find them
• Solid AWS cloud security experience covering IAM, network controls, and secure architecture patterns
• Practical incident response experience including experience being on call - you have led an incident before and know what a first class response looks like
• Working knowledge of SOC2 or a comparable compliance framework, mapped to engineering practice (not just audit readiness)
• The ability to communicate risk clearly to both technical and non-technical audiences
• Comfort working autonomously in a remote, cross-timezone environment - you know when to escalation and when to just get on with it

Responsibilities

• Lead security engineering for our Python/Django/React application, including code reviews, threat modelling, and security design reviews for new features and existing platform components
• Own static analysis, dependency scanning, secret scanning in CI and triage of findings
• Coordinate penetration testing - including agentic scanning using frontier models; internal red team testing and third party testing - and drive remediation of findings
• Partner with engineers to set secure coding standards and provide practical guidance
• SSO/MFA enforcement for internal tooling, on and offboarding processes and access reviews
• Secure, auditable staff platform access
• Collaborate with our Platform team to secure our AWS environment: IAM, network architecture, secrets management, and compute/data layer hardening
• Define and automate security baselines for infrastructure, including container security and CI/CD pipeline integrity
• Lead secure architecture reviews for new systems and significant infrastructure changes
• Build and maintain detection capabilities across our application, cloud, and SaaS stack, including anomaly detection and alerts
• Manage security incident response: triage, containment, investigation, stakeholder communication, and post-incident review
• Develop runbooks and response playbooks so that when incidents happen, we are ready
• Contribute to our SOC2 compliance program, including evidence collection, control monitoring, and audit readiness
• Conduct vendor and customer security assessments
• Communicate security risks clearly to engineering and leadership, and drive prioritisation of remediation work
• Contribute to keeping security policies and documentation current and fit for purpose
• Define the security roadmap, assessing priority based on impact and risk
• Act as a voice for security in architecture decisions
• Mentor engineers and other staff on security and build a security first culture
• Report on security posture to leads and other departments
• Advise and contribute to internal IT and physical security initiatives

Skills

Security engineering

Threat hunting

Python

AWS security

Incident response

Security risk comms

Tools

Django

React

Job description

DISCO is expanding its security program with a dedicated Security Engineer role focused on end-to-end security across applications, cloud, and incident response. You will drive secure design, threat modelling, and remediation across Python/Django/React stacks, with emphasis on AWS security and SOC 2 compliance.

You will collaborate with engineering, product, legal, and leadership while working remotely from Australia.