Principal Security Engineer

About the role

Checkbox is an AI-first SaaS platform for in-house legal teams, backed by Sequoia and serving customers such as SAP, Coca-Cola, Allianz, BMW, Elastic and Stryker. As it expands into AI-powered intake, matter management and work orchestration, it needs a hands-on Staff/Principal Security Engineer to own application, cloud and infrastructure security, SIEM, vulnerability management, customer trust and compliance. The role works with Product, Engineering, Platform, Identity, IT, Sales, Customer Success and Legal, and helps set guardrails for safe use of AI.

Key responsibilities

• Own application and infrastructure security, including secure development, cloud security, SaaS and API security and security reviews of new architectures
• Own the SIEM from detection through response, including alerting, investigation workflows and continuous improvement of security visibility
• Lead vulnerability management, including detection, triage, prioritisation, patching and coordination of internal and external penetration tests
• Evaluate and optimise security tooling such as SAST, DAST, SIEM and vulnerability management
• Lead compliance initiatives, audits and recertifications for SOC 2, ISO 27001, ISO 27017 and ISO 27018
• Own security policies, evidence, controls, audit documentation and the company trust centre, and act as point of contact for customer security queries
• Build practical AI security guardrails for internal teams using tools such as Copilot, Claude and Cursor

Required profile

• Strong experience in application, infrastructure, cloud or security engineering roles
• Experience securing modern SaaS web applications, APIs and cloud platforms
• Experience leading vulnerability management, penetration testing and remediation
• Extensive experience with compliance frameworks and audits, and with security policies and control documentation
• Ability to lead security initiatives end to end and communicate with customers
• Comfortable in a fast-moving start-up environment

Required skills

• Strong AWS experience, with good understanding of Kubernetes and containerisation
• SAST, DAST, secure SDLC and GRC platforms such as Vanta or Drata
• Infrastructure-as-code tools such as Terraform, OpenTofu, CloudFormation or Ansible
• At least one modern programming language such as Go or TypeScript, and Bash scripting
• CI/CD tooling such as GitHub Actions or ArgoCD

What we offer

• Competitive salary and hybrid working with team days in the Sydney CBD office
• Personal learning and development budget and flexible leave policy
• Expense policy and salary sacrifice options
• CBD start-up hub with snacks, drinks, premium coffee and team socials, plus company-wide events and annual off-sites