Security Architect

The Enterprise Security function delivers security architecture, engineering and strategy for BlueScope, helping protect our IT and operational technology environments and support safe, reliable operations.
We are seeking an experienced Security Architect for a 12 month fixed term contract to design, engineer and integrate security solutions across BlueScope’s systems, applications, infrastructure and delivery environments. Reporting to the IT Manager - Cyber Security Architecture, you will work with enterprise architects, cyber security teams, cloud and platform engineers, project teams, product owners, vendors and business stakeholders to embed secure-by-design principles and translate security requirements into practical, automated controls.
This role can be based in Melbourne (Mount Waverley), Sydney (Mascot) or Wollongong (Port Kembla), with hybrid working and three days per week in the office.
Key Responsibilities
You will combine security architecture expertise with hands on engineering and automation capability to strengthen BlueScope’s security environment. You will develop reusable patterns and guardrails, assess solution risk, integrate security platforms and help ensure controls are codified, tested, monitored and embedded within delivery pipelines.
Responsibilities include:
• Plan, design and govern security architectures across systems, applications, infrastructure, cloud, identity, data, networks, SaaS and API solutions.
• Conduct security assessments, define requirements and recommend practical risk remediation approaches for projects and technology changes.
• Develop and maintain security architecture artefacts, reusable patterns, standards, templates and guardrails under version control.
• Maintain security architecture alignment with enterprise architecture, cyber security strategy, standards and legislative obligations.
• Partner with technology, cyber security, business, vendor and operational technology stakeholders to improve security-by-design adoption and remediation outcomes.
• Contribute to BlueScope’s security uplift roadmap, control health reporting and continuous improvement of security capability.
• Manage security controls as code using Terraform and Azure DevOps templates, including automated policy validation and configuration drift detection.
• Embed automated security testing into CI/CD pipelines, including application, dependency, infrastructure-as-code, container and secrets scanning.
• Integrate security platforms and telemetry, including log and event onboarding to Microsoft Sentinel and connections across security, identity, asset management and IT service management platforms.
• Support security engineering across SIEM and SOAR, endpoint detection and response, vulnerability management, identity governance and the broader security toolchain.
You are a practical and collaborative security professional who can translate architecture into working, integrated capability. You bring:
• At least three years’ experience in a security architecture capacity.
• Proven experience in security threat and risk assessments, policy, architecture and design.
• Security architecture and engineering experience across SaaS, cloud, APIs, identity, threat and vulnerability management, data protection and network protection.
• Hands on experience integrating security platforms such as SIEM and SOAR, endpoint detection and response, vulnerability scanning and identity governance tooling.
• DevSecOps engineering capability, including policy and infrastructure as code, secure CI/CD pipeline design, Git-based workflows, secrets and key management, and container or Kubernetes security.
• Practical automation and integration skills using PowerShell or Python, REST APIs and connectors, together with security telemetry querying such as KQL in Microsoft Sentinel.
• Strong stakeholder engagement, written and verbal communication, analytical and problem solving skills.
• Information security certification such as SABSA, CISSP or SANS, or equivalent demonstrated capability.
Experience in heavy industry such as manufacturing, mining, oil and gas would be highly regarded. A tertiary qualification in IT, computer science or a related discipline, and cloud or DevSecOps certifications such as AZ-500, AWS Certified Security - Specialty, GIAC GCSA or Certified Kubernetes Security Specialist, would also be advantageous

Employment type
Full-time

Work arrangement
Hybrid