Senior Security Engineer

Commonwealth Bank of Australia; Bengaluru; On-site; INR 3,000,000 - 5,200,000; Full time

Job summary

Commonwealth Bank of Australia in Bengaluru seeks a Staff Security Engineer to lead secure design and implementation for complex systems. You will drive threat modelling, control mapping and risk identification while mentoring squads on secure coding practices.

Experts in Secure-by-Design, DevSecOps and security automation will shape patterns, reference architectures and security reviews across Docker/Kubernetes environments in the cloud (AWS/Azure).

Qualifications

• 12+ years of security engineering experience with secure software development.
• Proven expertise in Secure-by-Design, DevSecOps and security automation practices.
• Hands-on with threat modelling, STRIDE/STRIDE-LM, secure code reviews and risk analysis.
• Familiar with security reference architectures and control objective mappings.

Responsibilities

• Provide deep technical hands-on security engineering across secure design and implementation.
• Interpret policies, standards and architecture; map threats, controls and residual risk.
• Design reusable security patterns and guide cross-functional teams through build/run phases.

Skills

Secure Software Development

Secure-by-Design

DevSecOps

Security Automation

Threat Modelling

Docker Security

Kubernetes Security

Cloud Security (AWS/Azure)

AI Security & Threat Modelling

Security Assessments & Risk

Mentoring & Leadership

Education

Bachelor’s or Master’s in Engineering/CS/IT

Tools

Docker

Kubernetes

AWS

Azure

Job description

Staff Security Engineer – Bangalore

We’re building tomorrow’s bank today, which means we need creative and diverse engineers to help us redefine what customers expect from a bank. Envisioning new technologies that are still waiting to be invented and reimagining products that support our customers and help build Australia’s future economy.

Cyberscurity protects the bank and our customers from theft, losses and risk events, through effective and proactive management of cyber security, privacy and operational risk.

Impact & Contribution

Designing and implementing secure solutions that align with group security policies, standards, and reference architecture. Working on threat modelling and interpreting key cyber controls across the Group. Identifying security requirements, qualifying threats to design IT systems and building countermeasures to minimise cyber risks. Collaborating with cross‑functional teams to drive security outcomes throughout the design, build and run phases of product development. Supporting the adoption of modern scalable, high‑velocity security practices such as Secure by Design, DevSecOps and Automation. Contributing to the continuous innovation and re‑engineering of existing security engineering practices, including the development of practice strategies, patterns and processes. Providing expert guidance on security engineering best practices and supporting the response to high‑profile security incidents.

Roles & Responsibilities

• Provide deep technical hands‑on experience in security engineering, focusing on the design, strategy and implementation of secure solutions.
• Understand security policies, standards and reference architecture; expert in threat modelling, threat detection, control mapping, vulnerability analysis and risk identification.
• Design and build reusable security patterns or solutions.

Essential Skills

• 12+ years of Security Engineering experience with strong Secure Software Development expertise.
• Proven experience with Secure-by-Design, DevSecOps and Security Automation practices (SAST, DAST, IAST).
• Hands‑on with Secure Design Reviews, Threat Modelling (STRIDE / STRIDE‑LM), Secure Code Reviews and Risk Management.
• Experience authoring and reviewing security assessments, Security Zone Models, Data Flow Diagrams, Control Objectives, and Residual Risk analysis.
• Strong understanding of Security Reference Architectures, Security Patterns and Security Zone Models applied to solution design and reviews.
• Assessment of solutions using a Technology Criticality / Risk Rating framework to right‑size security controls.
• Identify control gaps, raise and manage risks, and align solutions to enterprise security policies and standards.
• Hands‑on experience securing Docker, Containers and Kubernetes environments.
• Experience with Cloud Security (AWS/Azure), including Cloud Reference Architectures, Workload Placement Patterns and Native Cloud Service Security Assessments.
• Partnering with Penetration Testing teams to explore and map exploit and attack paths.
• Familiarity with AI systems (GenAI, LLMs, RAG, AI Agents) and their security considerations, including AI threat modelling and secure AI design.
• Experience leveraging AI‑assisted security tooling to accelerate secure design.
• Mentoring engineering squads and security champions in secure design and coding practices.
• Knowledge of financial industry regulations and standards such as APRA and PCI‑DSS.

Preferred Certifications

• CISSP
• CCSP
• CSSLP

Education Qualification

Bachelor’s degree or master’s degree in Engineering, Computer Science or Information Technology.

Experience Level

Senior Level