Senior Security Engineer (AppSec)

⭐️ New Headcount!! ⭐️ Who are we? 👋 CreditorWatch is entering its next chapter — and it’s an exciting one. We’re a leading Australian data and technology company transforming how businesses manage commercial risk, make credit decisions and improve cash flow. Since 2010, we’ve built a strong position in the market, helping thousands of businesses make smarter decisions through our data, insights and technology. Following our acquisition by global private equity firm Warburg Pincus, we have a new opportunity to build on that success and take the business to the next level. With an established platform, ambitious growth plans and plenty of opportunity ahead, we’re focused on scaling our impact and shaping what comes next. We’re also proud to have been recognised as one of the AFR’s Top 10 Best Places to Work and certified by Great Place to Work across 2022–2025. For people who want to make a meaningful impact in a growing business, this is an opportunity worth exploring. Our Purpose ✅ Empower Australian businesses to trade confidently with their customers. Our Mission 🏆 We aim to be number one in our industry by delivering unique data insights and innovative products. Your role & team 🚀 We're looking for a Security Engineer to help strengthen security across CreditorWatch, protecting our corporate environment while embedding security into how our engineering teams build and deliver software. This is a hands-on, generalist role spanning enterprise security and product security. You'll work across everything from employee endpoints, identity and SaaS platforms to cloud infrastructure, applications and CI/CD pipelines. Joining our newly established Security Engineering function, you'll help us get more from our security tooling by actively operating, tuning and integrating solutions rather than simply purchasing them. You'll partner closely with Engineering and the wider business to improve our security posture, manage vulnerabilities and make secure development practices part of the way we work. 📍 Location: Sydney CBD 💼 Working arrangements: Full-time, hybrid 🤝 Reporting to: Principal Product Security Engineer What you'll own 🔍 🔐 Strengthen enterprise security - Improve security across our SaaS platforms, employee endpoints and office networks. - Implement, tune and operate enterprise security solutions across IAM, EDR, SSE, DLP and email security. - Improve threat detection and response through effective alert workflows, monitoring and operational runbooks. - Strengthen identity and access controls, applying principles such as least privilege and Zero Trust. 🛡️ Embed security into our products - Conduct security reviews, threat modelling and risk assessments across our products and applications. - Identify vulnerabilities and work with Engineering to prioritise practical remediation based on business impact. - Integrate security tooling into CI/CD pipelines, including SAST, SCA and secrets detection, with clear ownership and automated feedback. - Strengthen software supply chain security and CI/CD infrastructure to support secure development and deployment. 🤝 Enable secure engineering - Partner with Engineering to embed secure development practices across CreditorWatch's products and services. - Develop guidance and tooling that help engineers adopt AI/ML capabilities securely. - Support vulnerability management, ensuring findings are tracked, prioritised and remediated within agreed risk tolerances and service objectives. - Contribute security expertise to incident response, engineering enablement and compliance activities, including ISO 27001 and SOC 2. What success looks like in your first six months 🏁 - Stronger enterprise security: Key security tools are effectively configured, tuned and integrated, improving visibility and protection across our corporate environment. - Security built into delivery: Application security checks and automated controls are embedded into CI/CD pipelines, giving engineers actionable feedback without unnecessary delivery friction. - Better vulnerability management: Findings are consistently tracked, risk-prioritised and remediated, with clear ownership and accountability. - More secure products: Security reviews, threat modelling and practical remediation are helping reduce risk across our applications and services. - Stronger engineering partnerships: Engineers have clear guidance, practical tooling and support to make security part of their everyday work. - Improved security operations: Detection, alert handling and incident response processes are better defined, with clear workflows and operational ownership. What you'll bring 🧠 - Security experience: Hands-on experience across multiple security domains, with the versatility to work across enterprise and product security. - Application security: Experience with secure code reviews, threat modelling, SAST/SCA tooling and vulnerability management in cloud-native or SaaS environments. - Cloud security: Working knowledge of cloud security, preferably AWS, including IAM, networking, Security Hub, Inspector or GuardDuty. - Enterprise security: Familiarity with EDR, SSE/SWG, DLP, email security and application security posture management tools. - Identity & access: Strong understanding of SSO, OAuth, OIDC, SAML, conditional access and least-privilege principles. - Secure delivery: Experience embedding security into CI/CD pipelines and partnering with engineers to shift security left without slowing delivery. - Automation: Ability to script or automate workflows using Python, Bash or APIs. - Risk & compliance: Exposure to frameworks and standards such as ISO 27001, SOC 2 and the OWASP Top 10. - Communication: You can translate technical security findings into practical guidance for engineers and explain risk clearly to non-technical stakeholders. - Mindset: You're curious, adaptable and keen to work across a broad range of security challenges, taking a pragmatic and collaborative approach to improving security. A note on AI ✨ Use it. We'd think less of you if you didn't. We see AI as an opportunity to improve how we work, and we're interested in people who are already experimenting with it in practical ways. Write the first draft of your application yourself, then use AI to sharpen it rather than replace your thinking. You can also expect to use AI during at least one stage of the interview process. We're interested in how you work with it, not whether you can work without it. The perks? They’re pretty good 🎁 🏋️ Fitness First – Access to a Fitness First Platinum gym membership to help you stay active. ☕ Daily Fuel – Barista-made coffee, breakfast, snacks, lunches and drinks on us. You’re welcome! 📱 Phone Credits – $50 per month towards your phone plan. One less bill to worry about. ❤️ Wellness Days – An additional day off each month to recharge, focus on your wellbeing or spend time on what matters outside work. 💆 Monthly Massages – In-house massages to work out those knots and help you reset. 🎉 Fun Stuff – From wine tasting with a sommelier and sailing to escape rooms, darts, boat days and team activities, there’s always something happening. We also host Bring Your Family to Work Day, giving the people who matter most a chance to see where you spend your working day. 🏢 A Great Place to Work – Enjoy our state-of-the-art office space in the heart of Sydney CBD, designed to bring people together, collaborate and do great work. 📈 Learn & Grow – We’re big on development. With opportunities to build new skills, take on new challenges and explore career pathways, we want you to keep growing alongside the business. 🫶 Employee Assistance Program (EAP) – Access confidential support and resources to help you navigate personal or work-related challenges and look after your wellbeing. We’re committed to you ❤️ We value open communication, celebrating wins and creating an inclusive workplace where everyone can thrive. We’re proud to be an equal opportunity employer and welcome people from all backgrounds. Ready to join us? If you’re excited by the opportunity, we’d love to hear from you. Apply now.