Security Engineer (Application Security)

About the role

The Security Engineer (Application Security) will work hands‑on with engineering squads to embed security into software development, deployment and operation across Flybuys' technology estate. You will join the Cyber Security team and collaborate closely with Application Development, Cloud and Data teams.

Key responsibilities

• Implement and maintain security scanning tools in GitLab CI/CD pipelines, tuning them to reduce false positives.
• Build quality gates that deliver fast, actionable security feedback to developers.
• Maintain security‑as‑code artefacts across repositories and support teams in remediating findings.
• Triage and prioritize vulnerability findings from tools such as Wiz, AWS Inspector, Defender, SAST and DAST.
• Track remediation progress, contribute to dashboards and metrics, and recommend systemic fixes.
• Assist in implementing security guardrails across AWS, review IaC for misconfigurations, and participate in threat‑modelling sessions.

Required profile

• 2‑4 years of experience in security engineering, DevSecOps, software engineering or platform/infrastructure roles.
• Hands‑on experience with CI/CD pipelines and integrating security tools.
• Working knowledge of AWS services and native security features.
• Understanding of OWASP Top 10 and common web application vulnerabilities.
• Good communication skills to explain findings and recommendations to developers.

Required skills

• GitLab CI/CD
• AWS (IAM, networking, compute, security services)
• SAST, DAST, SCA, IaC scanning, container image scanning, secrets detection tools
• Security‑as‑code and automation scripting
• Familiarity with CNAPP platforms and API security concepts (desirable)

What we offer

• Flexible work‑from‑anywhere policy measured on outcomes
• Two well‑being days per year and volunteer leave
• Ongoing learning and development programs
• Employee discount card for Coles and Wesfarmers
• Quarterly team events, hybrid social gatherings and a starter kit