Senior Cyber Security Engineer

About the role

Compass, a global school management platform supporting 5,000+ schools, is looking for a Senior Cyber Security Engineer to work closely with its Head of Technology and help build the security roadmap. The role is a chance to work with senior leadership and help build a security function from the ground up, protecting a platform used by schools every day.

Key responsibilities

• Build the security roadmap, set standards and advise leadership on security risks, incidents and investment priorities
• Maintain a formal risk register covering vulnerabilities, remediation progress and residual risk
• Lead penetration testing across web apps, APIs, infrastructure and cloud, including third-party engagements
• Remediate security gaps including access control, database security (MongoDB, Redis, SQL), secrets management and cloud IAM
• Improve GCP security configuration (VPC, IAM, audit logging, Cloud Security Command Centre) and harden infrastructure with DevOps and platform engineers
• Review Terraform and CI/CD pipelines, cover OWASP Top 10 and guide the development team through a secure SDLC
• Oversee security investigations, audit and access cases, and own data access governance
• Lead incident detection and response, and design, maintain and test Business Continuity Plans and backup rotation strategies
• Mentor and manage junior team members

Required profile

• 5+ years of hands-on cyber security experience, with depth in application and infrastructure security
• Ability to identify and remediate vulnerabilities in production environments
• Experience managing or mentoring junior security staff
• Clear communication skills, able to explain technical risk to leadership and give practical guidance to engineers
• Familiarity with Australian SaaS compliance and privacy frameworks; highly regarded: UK/EU data protection (GDPR)

Required skills

• Penetration testing across web apps, APIs, networks and cloud, including third-party engagements
• Solid cloud security knowledge, particularly GCP or AWS (IAM, network security, audit logging, secrets management)
• Database security across relational and NoSQL systems
• Highly regarded: OSCP, CISSP, CISM or equivalent; prior experience in EdTech, SaaS or a high-growth scale-up

What we offer

• Hybrid working from the Melbourne office hub
• Learning and development opportunities, including a dedicated professional development budget
• 24/7 Employee Assistance Program, parental leave program and regular team events
• Employee referral program

To start, candidates need a valid Working with Children Check, a satisfactory National Police Check and proof of unrestricted work rights in Australia.