Senior Security Engineer

Commonwealth Bank; Bengaluru; Hybrid; INR 3,000,000 - 6,000,000; Full time

Job summary

Commonwealth Bank is seeking a Senior Security Engineer in Bengaluru to join the Secure Build & Deploy team. You will partner with software delivery teams to implement secure coding practices, embed security tooling into CI/CD pipelines, and drive DevSecOps initiatives across the SDLC.

The role emphasizes applying OWASP/NIST standards, risk-aware decision making, and collaboration with security champions to raise secure coding adoption.

Qualifications

• 8–12 years of experience in Security Engineering and Secure Software Development.
• Expert knowledge of application security concepts and frameworks (OWASP, NIST SSDF).
• Experience with CI/CD and DevSecOps practices is essential.
• Experience using application security tools such as Snyk and GitHub Advanced Security.
• Programming in Python is desirable.
• Strong written communication skills and ability to balance security with business needs.
• Risk mindset and understanding of risk management principles.
• Qualifications such as CSSLP or related degrees/certifications are advantageous.

Responsibilities

• Collaborate with software teams to ensure application security requirements across the SDLC.
• Develop and maintain policies, guidelines and control documentation.
• Support DevSecOps automated secure code tooling and embed security tools into CI/CD pipelines.
• Embed application security tools into CI/CD pipelines and pipelines, and manage SAST/DAST tooling.
• Report security initiative outcomes to leadership and stakeholders.
• Work with cross-functional teams to deliver secure software solutions.

Skills

Security engineering experience

Application security concepts

DevSecOps / CI-CD practices

Python coding

Risk management understanding

Education

Bachelor’s / Master’s in CS/Engineering/Cyber Security

Tools

GitHub Advanced Security

Snyk

Job description

At CommBank, we never lose sight of the role we play in other people’s financial wellbeing. Our focus is to help people and businesses move forward to progress. To make the right financial decisions and achieve their dreams, targets, and aspirations. Regardless of where you work within our organisation, your initiative, talent, ideas, and energy all contribute to the impact.

Job Title: Senior Security Engineer

Location: Bangalore

Business & Team: The Technology division delivers the group’s information technology and banking operation functions to ensure the highest levels of customer service through world-class process excellence and technology innovation. Group Security protects the bank and our customers from theft, loss, and risk events through effective and proactive management of cyber security, privacy and operational risk.

At CommBank we believe in working somewhere that works for you. We have many flexible working options available so talk to us about which arrangements could work best for you.

Team: Secure Build & Deploy team, a part of the wider Cyber Security team, partners closely with our wider engineering teams to govern and build DevSecOps automated security controls and capabilities.

Key Responsibilities of the Team

• Application Security: Code scanning capabilities (e.g. GitHub Advanced Security, Snyk), including related policies and procedures, reporting and support, to allow developers to self-identify security issues in the SDLC.
• Tooling & Automation: Develop and embed security tooling and capabilities into pipelines and the SDLC.

Impact & Contribution

• Improve the design and operating effectiveness of the Application Security control.
• Design and develop secure coding resources and guidelines.
• Maintain strategies and roadmaps for DevSecOps automated security tooling and capabilities (e.g. SAST, DAST, pipeline security).
• Liaise with Security Champions in software delivery teams to increase adoption of and support them in utilising secure coding practices and tooling.
• This role reports directly to the Secure Build & Deploy COE Team Lea.

Roles & Responsibilities

• Work with software development teams to ensure application security requirements are addressed and understood throughout the SDLC.
• Develop policies, guidelines, procedures and control documentation.
• Develop and/or support DevSecOps automated secure code tooling:
  • Embed application security tools into CI/CD pipelines.
  • Use or operate static, dynamic analysis and other software security tools.
  • Identify and triage false positives and false negatives from automated tools.
  • Work with development teams to resolve issues identified by application security tools.
• Report results of application security initiatives to stakeholders, including leadership, product management, risk and engineering colleagues.
• Work within a team environment and across business units to complete associated tasks with exceptional results.
• Undertake any other tasks assigned by your manager that you have the capability to perform safely. (NOTE: All tasks assigned and carried out must be performed in accordance with all relevant internal Bank policies and external regulatory requirements).

Essential Skills

• 8-12 years of experience in Security Engineering with strong expertise in Secure Software Development.
• Expert knowledge of application security and software security concepts and frameworks (e.g. OWASP & NIST SSDF).
• Experience with CI/CD and DevSecOps practices – essential.
• Experience in using or application security tools (e.g. Snyk, GitHub Advanced Security) – desirable.
• Coding/programming (e.g. Python) – desirable.
• Ability to consult with business and technical representatives and to balance security and business requirements.
• Strong written communication skills.
• Risk mindset and understanding of risk management principles.
• Your experience is ideally supported by one or more of the following qualifications:
  • Relevant industry certifications, such as CSSLP.
  • Tertiary qualifications in Software Engineering, Computer Science, Cyber Security or another related discipline.
  • Participation and membership of relevant industry associations.

Education Qualification

Bachelor’s degree or master’s degree in engineering in Computer Science/Information Technology.