Security Engineer, Application

Responsibilities

We are representing a confidential AI infrastructure client seeking a Security Engineer, Application to own application security across their GPU cloud platform and internal software. This is a senior technical role where automation is how you scale your impact.

Automation and secure delivery

• Own the CI/CD security gates that every production repository passes through: SAST, DAST, SCA, secrets detection, and SBOM generation
• Build the systems that do the repeatable work: finding triage, dependency uplift, evidence collection, and draft threat models
• Ship the secure paved roads other teams build on: reusable libraries, service templates, and developer tooling
• Write and review code in the services you protect, including the security-critical paths that tools miss

Security architecture and standards

• Set the application security standard and control for authentication, authorisation between services, tenant isolation at the application boundary, secret handling and logging
• Lead threat modelling and secure design review. Define what an attacker can do and what must be true before it ships
• Set the security requirements for AI assistants and agents including prompt injection and context poisoning
• Govern which tools and tool servers AI agents and software engineers may reach, and how those integrations are scoped, allow-listed, and audited

Assurance and vulnerability management

• Own application security posture across services: what is covered, what is open, what is accepted with a named owner and an expiry, and what is overdue
• Prioritise fixes on exploitability and exposure alongside CVSS and hold them to vulnerability SLAs
• Drive remediation with the teams that own the code so issues close at the source
• Extend SOC 2 Type 2 and ISO 27001 into the software delivery path as services and sites grow

Enablement and escalation

• Coach security champions inside each team so secure design decisions get made without waiting for you
• Provide application-security expertise during incidents and convert recurring failure modes into gates, tests, standards, or developer tooling
• Give engineering leadership a straight read on application risk and release readiness

What we're looking for

• Bachelor's degree in computer science or a related technical field
• 7+ years in application security, product security, or software engineering with a security focus
• Experience securing a public cloud or multi-tenant platform with a public API
• Deep, practical knowledge of the OWASP Top 10 and the OWASP API Security Top 10. Has threat modelled multi-tenant APIs in production using STRIDE or an equivalent method, both for REST and gRPC
• Has improved the security posture of software built by other engineering teams through standards, tooling, review, or secure-by-default patterns
• Has owned CI/CD security gates in production (SAST, DAST, SCA, secrets detection, SBOM) and tuned them to deliver actionable findings with low false-positive rates
• Writes production-quality code in at least one of Python, Go, or TypeScript
• Has replaced manual security work with automation: finding triage, dependency uplift, evidence collection, or regression tests
• Hands-on with LLM-backed or agentic features: prompt injection, tool misuse, agent identity and delegated credentials, cross-tenant data leakage, and controls on generated code reaching production. Familiar with OWASP guidance for LLM and agentic applications
• Deep practical experience with OAuth, OIDC, JWT, RBAC or ABAC, application-layer cryptography, token handling, and secrets in software
• Has worked under SOC 2 Type 2 or ISO 27001 and can produce evidence that a control ran
• Willing to join incident response for application and API security
• Willing to travel overseas occasionally when the role requires it
• Clear and effective written and verbal communication in English

Bonus points

• Experience securing AI agents, sandboxed code execution environments, or systems where AI-generated output can trigger automated actions
• Has run a vulnerability disclosure programme
• Security certifications with application-security depth, such as CSSLP or OSWE

How we work with you

When you apply through Get A Job.ai, our talent team will review your application and arrange an initial screening conversation. If there's a mutual fit, we will submit your profile to our client for consideration. We ask that you do not contact the client directly—we manage the introduction and represent your interests throughout the process.

Pay

Pay details will be discussed during the screening process based on experience and location (Sydney, Australia or Singapore).

Equal Employment Opportunity

Get A Job.ai is committed to equal employment opportunity and encourages applications from all qualified candidates regardless of race, colour, religion, sex, sexual orientation, gender identity, national origin, disability, or veteran status.