Product Security Engineer (Secure Software)

About the role

Boeing Defence Australia is recruiting a senior product security engineer in Brisbane to lead the embedding of secure software development practices on the MQ-28 program. The role is technical leadership with no direct reports, based at Boeing's Brisbane head office. It covers secure software development processes, security architecture patterns and LLM security in development toolchains and mission autonomy applications.

Key responsibilities

• Lead the embedding of secure software development: threat modelling at design, secure coding standards, dependency and supply-chain controls, SAST, DAST and SBOM in the pipeline, code signing and security acceptance at release.
• Support and coach DevSecOps resources and engineers in secure design and threat modelling practices.
• Produce the evidence needed for system accreditation (ISM, DSPF) as a by-product of the pipeline.
• Design and maintain reference security patterns for identity and access, secrets handling, cross-domain and classified data flows, logging, secure updates and configuration.
• Review system and software architectures at design review and translate ISM, Essential Eight and DSPF controls into engineering patterns.
• Set rules for LLM coding assistants and agents in the toolchain, advise on AI/ML security in autonomy systems, and build the test approach for AI components (prompt injection, tool abuse, model integrity).
• Act as the program's reference on the latest AI security guidance (ASD, NIST, allied partners).

Required profile

• Tertiary degree in an engineering or related technical discipline.
• Demonstrated experience applying engineering practices, standards and regulations across the development lifecycle.
• Experience translating ISM controls into engineering requirements.
• Australian citizenship to meet Defence security requirements.
• Desirable: experience with AI/ML in safety-related or autonomous systems, familiarity with DSPF, DISP, ISM and NIST accreditation, defence industry or government security experience, NV1 clearance (or higher).

Required skills

• Hands-on with a modern pipeline incorporating SAST, dependency scanning and SBOM generation in CI.
• Security architecture across identity, secrets, logging and data flows in a regulated environment.
• Working knowledge of LLM security: prompt injection, tool-use risk, agent permissions, model and data supply chain; deployed or secured at least one LLM-backed tool.
• Desirable: C, C++, Rust or Ada toolchains and embedded or real-time software; a relevant security certification (CompTIA+, CISSP, CISM, SSCP, etc.).

What we offer

• Flexibility including working from home, compressed work weeks and part-time arrangements.
• Remuneration, annual bonus, formal mentoring and training, and a reward and recognition program.
• Discounts on health insurance, travel and accommodation, paid study and parental leave, and health and wellbeing benefits.