Security Engineer (Remote, Australia)

About the role

DISCO, a SaaS platform for music and media workflows, is adding a dedicated Security Engineer role as it grows. The position covers application and internal security, cloud infrastructure, detection and response, and compliance, working closely with engineering, product, legal and leadership. It is fully remote and open to applicants living and working in Australia.

Key responsibilities

• Application security: lead security engineering for the Python/Django/React app, including code reviews, threat modelling and security design reviews, plus static analysis, dependency and secret scanning in CI and penetration testing (agentic scanning, internal red team and third-party testing)
• Identity and access: enforce SSO/MFA, manage on/offboarding and access reviews, and secure staff platform access
• Cloud and infrastructure security: secure the AWS environment (IAM, network architecture, secrets management, compute and data hardening), define automated security baselines and container security, and lead secure architecture reviews
• Detection and incident response: build anomaly detection and alerts, manage incident triage, containment, investigation and post-incident review, and write runbooks and playbooks
• Compliance and risk: support the SOC2 program, run vendor and customer security assessments, and communicate risks to engineering and leadership
• Security leadership: define the security roadmap, advise on architecture decisions, mentor engineers, report security posture and contribute to IT and physical security initiatives

Required profile

• 7+ years in engineering and 5+ years of hands-on security experience in product, application or security engineering
• Experience with threat hunting, threat intelligence or red teaming
• Solid AWS security experience and practical incident response experience, including on-call and leading an incident
• Working knowledge of SOC2 or a comparable framework mapped to engineering practice
• Ability to communicate risk clearly to technical and non-technical audiences, and to work autonomously in a remote, cross-timezone setting

Required skills

• Python/Django application security
• AWS security (IAM, network controls, secure architecture)
• Bonus: experience building a security program at a scaling startup, familiarity with the music industry or B2B SaaS, and certifications such as OSCP, CISSP or AWS Security Specialty

What we offer

• Competitive salary in a fast-growing startup
• Four weeks of paid vacation and two weeks of paid sick leave per year
• Paid parental leave, company laptop and monthly internet allowance
• Office set-up allowance, annual learning and development allowance, and flexible working