Principal Product Security Engineer

About the role

CommBank is looking for a Principal Product Security Engineer to join Group Security, a highly influential role focused on embedding security into software engineering practice across Retail Banking technology. You will work across a broad range of portfolios, partnering with engineering teams, technology leaders and security specialists to drive practical security outcomes, reduce risk and help teams build secure products at speed.

Key responsibilities

• Lead complex application security engagements across a diverse portfolio of products, platforms and engineering teams.
• Perform advanced web application penetration testing and security assessments to identify and validate vulnerabilities, attack paths and business risks.
• Conduct in-depth secure code reviews across modern technology stacks.
• Partner with engineers, architects and product teams to embed secure-by-design principles throughout the software development lifecycle.
• Provide expert guidance on application security risks, remediation strategies and security architecture decisions.
• Drive threat modelling and help teams identify and mitigate risks during design and development.
• Influence security outcomes in large-scale engineering environments through technical leadership and stakeholder engagement.
• Develop and enhance security tooling, automation and AI-driven capabilities to improve assessment coverage, efficiency and scalability.
• Mentor engineers and security practitioners and contribute to product security standards, testing methodologies and secure coding practices.

Required profile

• Extensive experience in Application Security, Product Security or Offensive Security, with a strong focus on web application security.
• Proven experience conducting threat modelling, architecture reviews, penetration testing and security assessments.
• Demonstrated ability to communicate complex technical risks and influence engineering teams.
• Experience in modern engineering environments using cloud platforms, CI/CD pipelines, DevSecOps and infrastructure-as-code.
• Passion for mentoring and driving a strong security culture.
• Nice to have: experience securing modern web frameworks (Next.js, React, Node.js, Java.NET, Go), assessing GraphQL, REST APIs, microservices and cloud-native apps, and certifications such as OSWE, OSEP, OSCP, GWAPT, GWEB, CISSP.

Required skills

• Web application penetration testing and secure code review
• Threat modelling and secure software engineering principles (OWASP)
• Modern authentication and authorization mechanisms, APIs and cloud-native architectures
• Automation, scripting and security tooling