Tech Security Engineer

Universal Music Australia Pty Limited; Sydney; Vor Ort; AUD 110.000 - 160.000; Vollzeit

Zusammenfassung

Universal Music Australia Pty Limited is seeking a Tech Security Engineer to enhance the security posture of their applications and platforms. This role involves application security assessments and partnering with engineering teams to remediate risks throughout the software development lifecycle.

The ideal candidate has 3–6 years of experience in Security Engineering and strong knowledge of application security concepts like OWASP Top 10. Familiarity with cloud environments such as AWS and hands-on experience with security testing tools are essential.

Qualifikationen

• 3–6 years of experience in Security Engineering, Application Security, or Software Engineering.
• Strong understanding of application security concepts, including OWASP Top 10.
• Hands-on experience with security testing tools such as Burp Suite and OWASP ZAP.

Aufgaben

• Perform application security reviews including design reviews and threat modeling.
• Conduct static and dynamic security testing (SAST/DAST) across web applications.
• Partner with engineering teams to remediate vulnerabilities.

Kenntnisse

Application security concepts

Web technologies and APIs

Security testing tools

Cloud environments (AWS, Azure, GCP)

Analytical and problem-solving skills

Ausbildung

3–6 years of experience in Security Engineering

Tools

Burp Suite

OWASP ZAP

Python

JavaScript

Jobbeschreibung

Job Summary

We are currently seeking a Tech Security Engineer to join UMG’s global Tech Security & Identity organization. Reporting to the IT Security Manager, this role is a hands‑on engineering position focused on improving the security posture of UMG’s applications, platforms, and cloud environments. This engineer will play a critical role in embedding security into the software development lifecycle by performing application security assessments, supporting vulnerability management, and partnering with engineering teams to remediate risk. The role spans multiple areas of security engineering with a strong emphasis on application and product security, including secure design, code review, and modern web security practices.

Job Functions

• Perform application security reviews including design reviews, threat modeling, and code analysis to identify and mitigate security risks.
• Conduct static and dynamic security testing (SAST/DAST), manual testing, and vulnerability assessments across web applications and APIs.
• Partner with engineering teams to remediate vulnerabilities and implement secure coding practices.
• Support secure software development lifecycle (SDLC) practices and integrate security tooling into CI/CD pipelines.
• Identify, track, and support remediation of vulnerabilities across applications and services in coordination with vulnerability management teams.
• Evaluate and implement security tools and platforms (e.g., SAST, DAST, API security, secrets scanning).
• Provide guidance on authentication, authorization, and secure integration patterns, including SSO and federation.
• Support cloud security efforts across AWS, Azure, or GCP environments, including application‑layer controls.
• Assist with security reviews of new applications, services, and third‑party integrations.
• Develop automation and tooling to improve security testing, vulnerability detection, and remediation workflows.
• Maintain documentation, standards, and best practices related to application and software security.
• Stay current with emerging threats, vulnerabilities, and industry best practices, and apply them to improve UMG’s security posture.
• Advocate for secure development practices and contribute to building a strong security culture across engineering teams.

Essential Qualifications

• 3–6 years of experience in Security Engineering, Application Security, or Software Engineering.
• Strong understanding of application security concepts, including OWASP Top 10 and common web vulnerabilities.
• Experience with web technologies, APIs, and modern application architectures.
• Hands‑on experience with security testing tools (e.g., Burp Suite, OWASP ZAP, Snyk, Checkmarx, Veracode, or similar).
• Experience with authentication and federation protocols (e.g., SAML, OAuth 2.0, OpenID Connect).
• Familiarity with at least one programming or scripting language (e.g., Python, JavaScript, Java, or similar).
• Experience working in cloud environments (AWS, Azure, or GCP).
• Strong analytical and problem‑solving skills with the ability to assess and communicate risk.
• Ability to work collaboratively with engineering teams to drive remediation and improve security outcomes.

Desirable Qualifications

• Experience integrating security into CI/CD pipelines and DevOps workflows.
• Familiarity with containerization and cloud‑native technologies (Docker, Kubernetes).
• Exposure to IAM concepts such as SSO, identity federation, and access control models.
• Understanding of security frameworks and standards (e.g., OWASP ASVS, NIST, ISO 27001).
• Relevant certifications such as Security+, CEH, CSSLP, or similar.
• Experience in large‑scale, global, or regulated enterprise environments.