Security Architect

About the role

BlueScope's Enterprise Security function delivers security architecture, engineering and strategy to protect its IT and operational technology environments. It is seeking an experienced Security Architect for a 12-month fixed-term contract, reporting to the IT Manager - Cyber Security Architecture. The role works with enterprise architects, cyber security teams, cloud and platform engineers, project teams, product owners, vendors and business stakeholders to embed secure-by-design principles and turn security requirements into practical, automated controls. The position can be based in Melbourne (Mount Waverley), Sydney (Mascot) or Wollongong (Port Kembla), with hybrid working and three days per week in the office.

Key responsibilities

• Plan, design and govern security architectures across systems, applications, infrastructure, cloud, identity, data, networks, SaaS and API solutions.
• Conduct security assessments, define requirements and recommend practical risk remediation approaches for projects and technology changes.
• Develop and maintain security architecture artefacts, reusable patterns, standards, templates and guardrails under version control.
• Keep security architecture aligned with enterprise architecture, cyber security strategy, standards and legislative obligations.
• Partner with technology, cyber security, business, vendor and OT stakeholders to improve security-by-design adoption and remediation outcomes.
• Contribute to the security uplift roadmap, control health reporting and continuous improvement of security capability.
• Manage security controls as code using Terraform and Azure DevOps templates, including automated policy validation and configuration drift detection.
• Embed automated security testing in CI/CD pipelines, including application, dependency, IaC, container and secrets scanning.
• Integrate security platforms and telemetry, including log and event onboarding to Microsoft Sentinel and connections across security, identity, asset management and IT service management platforms.
• Support security engineering across SIEM and SOAR, endpoint detection and response, vulnerability management, identity governance and the broader security toolchain.

Required profile

• At least three years' experience in a security architecture capacity.
• Proven experience in security threat and risk assessments, policy, architecture and design.
• Security architecture and engineering experience across SaaS, cloud, APIs, identity, threat and vulnerability management, data protection and network protection.
• Information security certification such as SABSA, CISSP or SANS, or equivalent demonstrated capability.
• Tertiary qualification in IT, computer science or a related discipline; cloud or DevSecOps certifications such as AZ-500, AWS Certified Security - Specialty, GIAC GCSA or CKS are advantageous.
• Experience in heavy industry such as manufacturing, mining, oil and gas is highly regarded.

Required skills

• Hands-on integration of security platforms such as SIEM, SOAR, EDR, vulnerability scanning and identity governance tools.
• DevSecOps: policy and infrastructure as code, secure CI/CD pipelines, Git workflows, secrets and key management, container or Kubernetes security.
• Automation and integration with PowerShell or Python, REST APIs and connectors, and telemetry querying such as KQL in Microsoft Sentinel.