Application Security Developer

We are seeking a specialist Application Security Developer to join our enterprise cybersecurity and engineering organization in Sydney.
This role is specifically tailored for a practitioner who brings a strong software engineering background paired with deep application security expertise. You will spearhead our initiative to uplift secure code scanning capabilities and implement AI-assisted remediation workflows across our software development lifecycle (SDLC), ensuring that applications, microservices, and modern integrations are built securely by design.
Key Responsibilities
Secure Code Scanning Uplift: Design, configure, and optimize enterprise static (SAST), dynamic (DAST), and dependency (SCA) code scanning capabilities to ensure robust coverage across all development squads.
AI-Assisted Remediation: Pioneer the implementation of AI-driven tools and LLM-assisted workflows to automate vulnerability triage, accelerate code review, and provide developers with automated remediation guidance.
Secure Coding & Remediation Guidance: Review code, diagnose complex vulnerabilities (OWASP Top 10, CWE, LLM security risks), and partner directly with engineering squads to resolve security findings in modern languages (e.g., Python, Java, Go, Node.js/TypeScript).
API Security & Identity Guardrails: Build secure application components and authentication/authorization controls, integrating seamlessly with enterprise identity platforms (Ping Identity, Entra ID) using OAuth 2.0, OIDC, and JWT validation.
Pipeline Integration & Shift-Left: Embed security guardrails and automated scanning controls directly into modern CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps) without hindering delivery velocity.
Threat Modeling & Enablement: Conduct threat modeling assessments during feature design phases and create reusable security standards to foster a strong developer-first security culture.
Essential Experience:
Dedicated Application Security & Developer Background: Proven track record combining hands-on software development experience with specialized application security engineering.
Secure Code Scanning & Pipeline Uplift: Practical, hands-on experience setting up, tuning, and scaling enterprise code scanning tools (SAST/SCA/DAST) within automated CI/CD pipelines.
AI-Assisted Security Tools: Demonstrated familiarity or practical experience leveraging AI/LLM tools for automated code review, vulnerability triage, or security remediation workflows.
Application & API Security Mastery: Deep technical understanding of web/API security, secure authentication/authorization protocols (OAuth 2.0, OIDC), and common software vulnerabilities.
Location: Sydney-based (hybrid) with full Australian working rights.
Desirable:
Exposure to secure AI/LLM integration patterns, prompt security guardrails, or model risk controls.
Experience interfacing with enterprise identity platforms (e.g., Ping Identity) or vulnerability management platforms (Tenable).
Relevant industry certifications (CSSLP, GWAPT, GWEB, OSCP, or CASE).

Skills
Python, JavaScript, TypeScript, Node.js, Java, Golang, Microservices, Git, Azure, CI/CD

Employment type
Full-time

Work arrangement
Hybrid