Software Engineer (Security)

Acorn; Canberra; On-site; AUD 125,000 - 160,000; Full time

Benefits offered by this job

Office-based role

Competitive salary + 12% superannution

Opportunities to work with government-

Job summary

Acorn is seeking a Software Engineer (Security) to strengthen our PLMS platform. You’ll collaborate with every product team, reporting to the Director of Information Security, and own secure-by-design practices across code, tests and deployments.

In this IC3 role, you’ll mentor peers, lead threat modelling, and help shape secure architectures while partnering with Infrastructure and Engineering. You’ll build with PHP, React+TypeScript and Terraform to ship fixes and tooling, focusing on speed

Qualifications

• 3+ years building production web applications in PHP, with the habits that go with it: tests, code review and CI.
• Experience with application security: OWASP Top 10, injection, access control, SSRF.
• Hands-on experience with a cloud platform (ideally AWS) and infrastructure-as-code (ideally Terraform).
• Comfortable in agile product teams: two-week sprints, refinement and estimation, shipping behind feature flags.
• Ability to explain security risk to product managers and developers in plain language.
• Baseline security clearance preferred, or ability to obtain one.
• Nice to have: CI security tooling, identity work (SAML, OIDC), Australian government frameworks (ISM, Essential Eight, IRAP), or bug-bounty experience.

Responsibilities

• Review pull requests for security issues and provide actionable feedback.
• Triage and fix findings from code, dependency, container and cloud scanning.
• Threat-model new features and translate results into tests and acceptance criteria.
• Build secure-by-default patterns in code and infrastructure (auth, input validation, tenant isolation, secrets handling, least-privilege, CI gates).
• Collaborate with Infrastructure and development teams on fixes, platform changes and rollouts.
• Support customer security reviews, pen-test remediation and incident response with evidence from code.
• Ship fixes and tooling in PHP, React with TypeScript and Terraform, with tests and production follow-through.

Skills

Security engineering

Threat modelling

Technical leadership

Mentoring

Tools

PHP

React

TypeScript

Terraform

AWS

Job description

Are you a developer who would rather ship the security fix than file the finding? We'd love to hear from you!

About Acorn

At Acorn, we are on a mission to transform the corporate learning experience. Our cutting-edge Performance Learning Management System (PLMS) software is powered by AI and designed to ensure that what people learn directly contributes to their exceptional performance in business. Corporate performance and learning needs a revolution, and Acorn is the antidote. We are the only solution that guides learners step by step to master the specific capabilities required for their roles, ultimately accelerating organisational performance.

Location

We are open to individuals based in Canberra or Sydney. This is a full-time in office role.

Role overviewThis is a new, full-time Software Engineer (Security) role for someone who codes, reporting to our Director of Information Security. With government customers and SOC 2 Type II, you'll work across every product team to make the Acorn platform harder to attack and faster to fix. This is an IC3 role, which at Acorn means you're an experienced specialist and the go-to person in your domain: you operate with autonomy, make decisions within your area of expertise, recommend improvements to how we work, and mentor others without formal direct reports.

5 key capabilities

The best part… we use our Acorn software at Acorn. We believe in the power of our Managers and Staff being aligned on the 5 capabilities needed for each role, and the level that we expect for any given role, using our Acorn AI tool to streamline this consistently across our business. The 5 levels comprise Foundational, Developing, Proficient, Advanced and Expert.

Here are the 5 key capabilities for the role and the level expected to give you an idea of what the role entails

1. Application Security & Vulnerability Management

Embed secure design and manage vulnerabilities based on business risk to reduce exposure, protect customer trust, and sustain reliable software delivery.

Level - Proficient:

At the proficient stage, you lead building security into design and own vulnerability triage to closure. You streamline pipelines and coach engineers. Your work shortens remediation time and reduces risk.

2. Software Engineering Excellence

Design, build, and evolve secure, scalable, and maintainable software systems to deliver dependable customer value, minimise risk, and drive measurable business outcomes.

Level - Proficient:

At the proficient stage, you own design and build of reliable, scalable, secure software with clean code and tests. You improve performance and delivery, fix root causes, meet business goals.

3. Secure Architecture & Threat Modelling

Design secure architectures and assess threats to prioritise risks and define controls that reduce exposure and enable resilient, scalable delivery.

Level - Proficient:

At the proficient stage, you lead threat modelling and shape designs. You prioritise risks, define practical controls, and work early with engineers. This reduces attack surface and speeds secure delivery.

4. Cloud, IAM & Platform Security Engineering

Design, implement and evolve cloud platform security and identity architectures to minimise risk, protect services, and enable compliant, reliable delivery.

Level - Proficient:

At the proficient stage, you lead cloud security improvements. You design access and network protections, automating policy and detection with platform teams. Your work reduces risk and speeds compliant delivery.

5. Technical Leadership & Mentoring

Provide technical leadership and mentor teams in security engineering to embed secure-by-design practices that reduce risk, protect customer trust, and improve delivery outcomes.

Level - Proficient:

At the proficient stage, you lead hands-on security efforts and coach peers on complex work. You set standards, review designs and code, and ready teams for security incidents, reducing risk.

Key responsibilities

• Review pull requests for security issues and give feedback a developer can act on
• Triage and fix findings from code, dependency, container and cloud scanning at the root cause
• Threat-model new features with the team building them, and turn the results into tests and acceptance criteria
• Build secure-by-default patterns the development teams reuse, in code and infrastructure: authentication, input validation, tenant isolation, secrets handling, least-privilege access and CI security gates
• Partner with Infrastructure and development teams on shared fixes, platform changes and rollouts
• Support customer security reviews, penetration-test remediation and incident response with evidence from the code
• Ship your own fixes and tooling in PHP, React with TypeScript and Terraform, with tests and production follow-through

Required experience

• 3 or more years building production web applications in PHP, with the habits that go with it: tests, code review and CI.
• Working knowledge of application security: the OWASP Top 10, how injection, broken access control and SSRF appear in code, and how to fix them properly.
• Hands-on experience with a cloud platform (ideally AWS) and infrastructure-as-code (ideally Terraform).
• Comfortable in agile product teams: two-week sprints, refinement and estimation, and shipping behind feature flags.
• You can explain a security risk to a product manager and a developer in plain language.
• Baseline security clearance is preferred, or the ability to obtain one.
• Nice to have: CI security tooling (SAST, SCA), identity work (SAML, OIDC), Australian government frameworks (ISM, Essential Eight, IRAP), or CTF and bug-bounty experience.

AI Fluency

At Acorn, we use AI across everything we do, and are actively building our AI fluency across the business. We're genuinely excited about what AI makes possible in secure software engineering, and we'd love someone who feels the same way.

In this role, that looks like:

• Building with AI coding assistants every day to review, refactor and ship secure code faster
• Knowing where AI is unsafe and designing guardrails for it: secrets in prompts, generated code that skips an authorisation check, and dependencies that don't exist
• Using AI to speed up triage of scanner findings, draft threat models and turn findings into clear, actionable guidance for developers

We're not looking for someone who can talk about AI in the abstract. During the interview process, we'll ask you to walk us through what you've actually built, the tools you use daily and the results you've seen. We love seeing how people are evolving and enhancing the ways they work with AI.

Why Join Acorn?

• Our work protects the learning records of millions of people, and some of it is audited by government customers.
• You'll be our first engineer with a full-time security remit, mentored by the Director of Information Security, in a programme that is building, not maintaining.
• You'll work with every product team and Infrastructure, so you see the whole platform, not one corner of it.

Compensation

One of our core values is transparency and we believe in being upfront with candidates throughout the recruitment process, to make sure expectations are aligned. This role sits within a salary range of $125,000 to $160,000 AUD + 12% superannuation contribution, commensurate with experience and qualifications.

Location

We are open to individuals based in Canberra or Sydney, Australia. We are an office-first company, meaning we work from our local offices the majority (if not all) of the time. We want to create cool stuff with great people, and we know from experience that is best done through daily moments like the coffee run, walk to grab lunch, or quick huddles.

Being able to capitalise on this is key to our ongoing success and a large part of the reason we can work at the pace we do. Please note candidates will need to be in commuting distance to our offices based in Canberra or Sydney CBD.

Applicants must have full working rights in Australia to be considered for this role. Unfortunately we are unable to provide visa sponsorship at this time.

Our recruitment process

Acorn is committed to fostering a diverse and inclusive workplace where everyone feels valued and respected. We are an equal opportunities employer and welcome applications from all qualified candidates. We aim to ensure that our recruitment process is fair and accessible to everyone and encourage candidates to request any accommodations needed during the application or interview stages.

About Acorn

Acorn is the hub for learning and performance for over 3 million active learners globally. The work you do - whether that's writing lines of code, designing the layout of a dashboard, or talking to customers - helps real people grow not just professionally, but personally. In the space of 10 years, we've grown to a global platform in the heart of many major organisations' ecosystems.

There's still so much more to do, and we need people who are keen to help us journey into the next phase on board! And since we're still growing, there's so much you can learn on that journey with us. To find out more about life at Acorn, our Values and working with us, check out our website at https://acorn.works and see our Life At Acorn video here! https://youtu.be/2BGUk-n3FrQ?si=U_sS1Y5ZSP0tNtZW