Principal Security Engineer (Generalist)

Principal Security Engineer (Generalist)
About Us:
Infosys is a global leader in next-generation digital services and consulting. Over 320,000 of our people work to amplify human potential and create the next opportunity for people, businesses and communities. We enable clients in 59 countries to navigate their digital transformation. With over four decades of experience in managing the systems and workings of global enterprises, we expertly steer clients, as they navigate their digital transformation powered by cloud and AI. We enable them with an AI-first core, empower the business with agile digital at scale and drive continuous improvement with always-on learning through the transfer of digital skills, expertise, and ideas from our innovation ecosystem. We are deeply committed to being a well-governed, environmentally sustainable organization where diverse talent thrives in an inclusive workplace.
Visit to see how Infosys (NYSE: INFY) can help you navigate your next.
Recognized as the Top Employer in Australia for the second year in a row, Infosys offers a workplace where careers grow with purpose. As an AI first organization, we empower our people to work on next generation technologies, continuously learn, and create impact at scale-supported by a culture rooted in care, inclusion, and excellence.
Join Infosys and be part of a culture that's not just promised-it's certified.
Role Description: The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.
Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains-including cloud security (multi-cloud), application security, identity & access management, and threat modeling.
Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.
Location: Melbourne
Salary: AUD 150,742 - 171,215 Annual Gross
Please Note: - The above salary range is only indicative and maybe subject to suitable enhancements, based on internal company processes
Flexible working arrangements (hybrid, reviewed case-by-case basis). Feel free to connect with your recruiter to learn more about how this works in practice.
Roles and Responsibilities: 1. Security Engineering, Architecture & Solution Design

• Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.
• Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).
• Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.
• Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.
• Collaborative Threat Modeling: Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements.

2. Cybersecurity Governance, Risk Assessment & Exception Management

• Security-Based Risk Assessments: Lead and execute detailed, security-based risk assessments for critical enterprise systems, infrastructure migrations (e.g., legacy to AWS Workspaces), and external third-party integrations, ensuring risks are documented, quantified, and managed in alignment with risk appetite.
• Consulting-Led Risk-Based Control Design: Provide advisory consulting across engineering and business units to facilitate risk-proportionate control design. Shift security from a rigid checklist exercise to a dynamic, risk-based modeling framework that secures the business without slowing delivery.
• Control Definition & Baselines: Establish, review, and maintain the organization's technical security "Non-Negotiables" and baseline security controls.
• Pragmatic Risk & Exception Management: Lead the technical security exception and risk acceptance workflows. Partner collaboratively with business and technology stakeholders to design, validate, and document robust compensating controls when standard security patterns cannot be met.
• Governance Representation: Act as the premier technical security representative on risk and governance forums, providing objective, risk-based assessments that balance business agility with the bank's defined risk appetite.
• Data Classification & Lifecycle Governance: Ensure all designs, risk assessments, and patterns adhere strictly to internal data classification frameworks (C1-C4), ensuring appropriate security controls are mapped directly to data sensitivity.

3. Regulatory Compliance & Data Privacy

• Regulatory Alignment: Ensure all security engineering designs, patterns, and integrations align with critical Australian prudential standards, specifically APRA CPS 234 (Information Security) and APRA CPS 230 (Operational Resilience).
• Data Residency & Sovereignty: Design, validate, and enforce technical controls governing data residency, sovereignty, cross-border data transfers, and compliance with the Privacy Act 1988 (including OAIC and ATO mandates).
• Third-Party Risk Mitigation: Evaluate and design secure integration patterns for external third-party SaaS, PaaS, and partner integrations, validating that external systems meet stringent organizational security and data protection standards.

4. Technical Leadership, OKRs & Culture

• Strategic Execution: Translate cybersecurity strategic "Must Wins" and key Objectives & Key Results (OKRs) into tangible, pragmatic technical deliverables for delivery and platform engineering teams.
• Community & Mentorship: Drive and cultivate a vibrant security champion community. Mentor mid-level and senior engineers to elevate collective security engineering capability across the organization.
• Security Evangelism: Act as an advocate for secure coding practices, Infrastructure as Code (IaC) security, and general security awareness across blended, cross-functional agile teams.

5. Identity, Access & Platform Governance

• Access Control Patterns: Define and govern modern, secure access patterns-including federated identity (SAML, OAuth 2.0), single sign-on (SSO), and privileged access management (PAM)-across cloud systems, analytics platforms (e.g., PowerBI), and corporate directories.
• Identity Lifecycle Automation: Guide the technical implementation of automated user provisioning, de-provisioning, and regular access attestation flows, ensuring strict adherence to the principle of least privilege.
• Endpoint & Mobile Security Policy: Partner in refining MDM (Mobile Device Management) and BYOD (Bring Your Own Device) security baselines to prevent data leakage while maintaining compliance with relevant financial and privacy regulations.

Technical Expertise & other qualifications (Essential) Technical Experience

• Broad Security Domain Expertise: Extensive, hands on experience spanning multiple security disciplines, such as Cloud Security, Application Security (AppSec), Identity & Access Management (IAM), Network Security, and GRC.
• Multi-Cloud Expertise: Proven track record in securing enterprise workloads across hybrid cloud architectures, with deep exposure to AWS and/or Google Cloud Platform (GCP/GCVE).
• Infrastructure as Code (IaC) & Automation: Strong expertise in securing IaC and configuration management frameworks (e.g., Terraform, Ansible) to enforce compliance-as-code.
• Secure SDLC & DevSecOps: Deep understanding of modern CI/CD pipelines, containerization (Docker, Kubernetes), and the automated integration/orchestration of security testing tools (SAST, DAST, SCA, secrets detection).
• Modern Identity & Directory Services: Strong knowledge of federated identity, directory integrations, and securing external/guest user access within Microsoft Entra ID (Azure AD), Okta, or similar Identity Providers.

Regulatory, Risk & Consulting Acumen

• Solid Risk Management Capability: Proven ability to identify, analyze, and manage information security and operational risks. Hands on experience designing and executing comprehensive security based risk assessments.
. click apply for full job details