Staff Security Engineer

Nearheal Pty Ltd (trading as Nearheal); Sydney; Hybrid; AUD 180,000 - 240,000; Full time

Benefits offered by this job

Equity packages

Parental leave policy

Vibe & Thrive allowance

Flexible leave options

Job summary

Canva is seeking a Staff-level security engineer to join the Internal Systems Security team in Sydney. You will set technical direction for enterprise security, focusing on AI-enabled workflows, MCP policy, and production security across endpoints, networks, identities, and SaaS tools.

You will partner with engineering across the business to identify risks, build roadmaps, and implement controls, while automating and standardising security practices for scale.

Qualifications

• Hands-on enterprise, corporate or internal security engineering experience.
• Built and run security services in production (endpoints, networks, identity, SaaS estates).
• Able to automate security work and write/review code to a high standard.

Responsibilities

• Go out to teams across the business to identify real risks and build a collaborative roadmap.
• Help teams turn on AI workflows safely and efficiently.
• Review new tools and agents before deployment and set appropriate policy settings.
• Threat modelling newer patterns (MCP, agentic workflows, SaaS-to-SaaS) and translate findings into controls.
• Set standards and automate processes to scale security work without scaling headcount.

Skills

Security engineering

Threat modelling

Code proficiency

Automation

Cross-team collaboration

Terraform

Python

Go

Tools

Terraform

Python

Go

Job description

Join the team redefining how the world experiences design.

Thanks for stopping by. We know job hunting can be a little time-consuming, and you're probably keen to find out what's on offer, so we'll get straight to the point.

About the team

The Security Group protects Canva's systems and data from information security threats, across Application Security, Risk Management, Enterprise Security, and Threat Detection and Response. Internal Systems Security is the team inside that focused on Canva's own environment.

What you'd be doing in this role

The Internal Systems Security team secures the environment Canvanauts work in every day. Laptops, networks, identities, the SaaS tools everyone relies on, and now the AI agents doing real work alongside us.

Most of this work used to follow a playbook. That's no longer true. Canvanauts now run AI agents that act on their behalf, which is a very different security problem to a person at a laptop. One of the questions on our plate right now: where does the policy layer sit for MCP tool calls, when we want decisions made per action rather than per application, and evaluated fast enough that nobody notices them?

This is a Staff level individual contributor role. You'd set technical direction without managing anyone.

At the moment, that means:

• Going out to teams across the business, working out where their real risks sit, and building the roadmap with them rather than handing them one.
• Helping those teams turn on AI workflows safely, instead of being the reason they can't.
• Reviewing new tools and agents before they land. We're the team that says yes, no, or yes with these settings.
• Threat modelling newer patterns like MCP, agentic workflows and SaaS to SaaS integrations, then turning what you find into controls people adopt.
• Setting the standards other teams build against, and automating the work so a multiplying workload doesn't need a bigger team.

You're probably a match if:

• You go looking for problems. You can point to something you found yourself, got other people to care about, and saw through to a fix.
• You can bring people with you. You've convinced an IT or engineering lead to take on something that wasn't on their roadmap, without a mandate.
• You've done hands‑on enterprise, corporate or internal security engineering, and built and run security services in production. Endpoints, networks, identity, SaaS estates.
• You value concepts over tools. Knowing the tooling matters. Knowing why a control works matters more.
• You write and review code to a standard other engineers trust, and you automate by default.

Nice to have

• Security work across a broad enterprise, especially somewhere less obvious like marketing or sales.
• macOS at fleet scale: device trust, posture signals, zero trust, certificate‑based device attestation.
• SaaS security posture: configuration baselines, SSPM, OAuth and third party integration risk, non-human identities.
• Securing AI agents, MCP servers or agentic workflows. Action level policy, tool call mediation, audit trails and containment.
• Terraform, Python or Go, and cloud in AWS or GCP.

Where and how you can work

Our flagship Sydney campus is uniquely Canva, an extension of our Surry Hills neighbourhood. It's a thoughtfully designed space with plenty of room to collaborate, focus, and connect. This role is based in Sydney, and we're looking for someone who calls it home. Our hybrid way of working gives you the flexibility to work remotely, and to come together on campus for meaningful in‑person collaboration and connection when it matters most. We trust our Canvanauts to choose the balance that empowers them and their team to achieve their goals.

What's in it for you?

Achieving our crazy big goals motivates us to work hard, and we do, but you'll experience lots of moments of magic, connectivity and fun woven throughout life at Canva too. We also offer a range of benefits to set you up for every success in and outside of work.

Here's a taste of what's on offer:

• Equity packages, because we want our success to be yours too
• Inclusive parental leave policy that supports all parents and carers
• An annual Vibe & Thrive allowance to support your wellbeing, social connection, office setup and more
• Flexible leave options that empower you to be a force for good, take time to recharge, and support you personally

Check out lifeatcanva.com for more info.

Other stuff to know

We make hiring decisions based on your experience, skills and passion, as well as how you can enhance Canva and our culture. When you apply, please tell us the pronouns you use and any reasonable adjustments you may need during the interview process.

We celebrate all types of skills and backgrounds at Canva, so even if you don't feel like your skills quite match what's listed above, we still want to hear from you.

Please note that interviews are conducted virtually.