Principal Advisor Cyber Security Architecture (AppSec)

About the role

Rio Tinto is looking for a Principal Advisor - Cyber Security Architecture (AppSec) to lead the Application Security domain within Cyber Security. The role owns the strategy, standards, architecture and roadmap for secure software development and application security services across the company, working with Enterprise Architecture, software engineering, platform teams and business stakeholders. It sits within the Cyber Architecture team and reports to the Manager of Cyber Security Architecture. The position is permanent and full-time, based in Perth or Brisbane.

Key responsibilities

• Own the enterprise Application Security strategy, standards, reference architectures and service roadmap.
• Lead and improve Secure SDLC, DevSecOps, threat modelling and secure application development practices.
• Embed security requirements into engineering standards, delivery processes and CI/CD pipelines with development, architecture and platform teams.
• Own and support Application Security tooling and services, including Snyk and integrations with GitHub, Azure DevOps and Artifactory.
• Guide teams in identifying, prioritising and remediating application and dependency vulnerabilities.
• Define reusable security patterns for applications, APIs, cloud-native workloads, containers, secrets and AI-enabled solutions.
• Review solution designs for higher-risk initiatives and advise projects and development teams.
• Mentor other architects and build relationships across Cyber, IS&T and the development community.

Required profile

• Strong Application Security experience at enterprise scale, with a practical, approachable style.
• Experience creating and embedding security standards, patterns and guidance across development teams in a large, complex organisation.
• Proven experience owning or supporting Application Security platforms such as Snyk, including developer onboarding, integrations, service improvement and vulnerability remediation.
• Relevant qualifications or certifications in cyber security, information security, software engineering or a related discipline, or equivalent practical experience.

Required skills

• Application Security architecture, Secure SDLC, DevSecOps, threat modelling, vulnerability management and security-by-design.
• Helpful: GitHub, Azure DevOps, Artifactory, CI/CD security, API security, secrets management, container security and software supply chain security.
• Helpful: experience with cloud-native and AI-enabled software development, and familiarity with OWASP, NIST, ISO 27001, CIISec or OFIA.

What we offer

• A permanent position with a competitive base salary and annual incentive program.
• Medical benefits including subsidised private health insurance for employees and immediate family, and company-provided insurance cover.
• An attractive share ownership plan and extensive salary sacrifice and salary packaging options.
• Career development and education assistance, and family-friendly health and wellbeing support.
• Vacation, paid parental, sick and cultural leave, and employee discounts.