Application Security Engineer

We're looking for an Application Security Engineer to join the Software Engineering group at our financial services client in Sydney. Your job is to build on an already developed engineering practice and then begin to look at data, investment and digital engineering teams. You'll make sure security findings are prioritised by real risk, fixed, and tracked until the fix is verified.

What you'll be doing

• Reviewing results from application security tools covering SAST, DAST, SCA, secrets, API, container and infrastructure-as-code scanning, confirming genuine impact and weeding out false positives, duplicates and recurring root causes
• Ranking findings by severity, exploitability, how critical and exposed the asset is, and the business context, in line with the vulnerability management process
• Giving engineers clear, practical fix guidance, and keeping a traceable record from each finding to its remediation ticket, owner, due date, exception and closure evidence
• Owning secure SDLC controls from design through to ongoing maintenance, including the control requirements, implementation guidance, evidence expectations and reviews of whether the controls work
• Overseeing GitHub security and related integrations: repository baselines, access reviews, branch protection, pull-request rules, code ownership, secrets protection, scanning, status checks, ticketing and exception handling
• Reporting on the health, risk and trends of the remediation backlog, escalating overdue or blocked items, verifying completed fixes, keeping security records up to date, and managing risk exemptions from approval through to review or expiry

What you'll bring

• Strong analytical skills and a track record of triaging and prioritising application security findings
• Working knowledge of SAST, DAST, SCA, secrets, API, container and infrastructure-as-code scanning, plus OWASP Top 10, API Security Top 10, common CWEs and software supply-chain risks
• Experience defining, implementing and assessing secure SDLC controls across the full lifecycle
• The ability to turn technical findings into clear, actionable guidance for engineering teams
• Experience with vulnerability management workflows, ticketing, backlog management, reporting and evidence-based closure
• Deep GitHub security knowledge, including repository governance, access models, branch protection, pull-request controls, code ownership, GitHub's security features and application security integrations
• Strong stakeholder engagement, written communication and follow-through