Staff Security Engineer (AppSec)

About the role

CreditorWatch, an Australian data and technology company acquired by Warburg Pincus, is hiring a Staff Product Security Engineer in Sydney CBD. This is a senior, hands-on individual contributor role reporting to the Head of Security, working with Engineering, Platform, Data, IT and Risk teams to turn security strategy into practical controls, platforms and engineering practices.

Key responsibilities

• Shape security engineering and architecture: define security standards, reference architectures and guardrails, and lead threat modelling, secure design reviews and risk assessments.
• Drive automation and scalable security controls, detections and evidence across platforms.
• Implement AWS security controls (account architecture, IAM, network segmentation, workload protection, CSPM) and strengthen CI/CD and supply chain security (SAST, SCA, secrets detection, IaC, container security).
• Embed security checks and feedback into the SDLC, and deliver the identity and Zero Trust roadmap (SSO, conditional access, privileged access).
• Set up frameworks and tooling for safe AI/ML adoption, including security patterns for AI agents and agentic tools.
• Mentor security engineers, partner with technical and business leaders, and contribute to ISO 27001, SOC 2 and regulatory assurance.

Required profile

• 6+ years of hands-on security engineering, ideally in a cloud-native, SaaS or financial services environment.
• Proven ability to influence senior engineers, shape security architecture and lead cross-functional initiatives.
• Clear communicator who can explain complex security risks and mentor others.

Required skills

• AWS security across multi-account architecture, IAM, networking and workload hardening.
• Secure design reviews, threat modelling and SAST/SCA/DAST tooling.
• CI/CD pipeline, IaC, container and secrets security, and build integrity.
• Python, Go, TypeScript or similar, with scripting and API automation.
• EDR, SSE/SWG, DLP, OAuth, OIDC, SAML and Zero Trust.
• Cryptography, PKI, TLS, ISO 27001, SOC 2 and OWASP exposure.

What we offer

• Fitness First Platinum gym membership, daily food and drink, $50 monthly phone credit and an extra day off each month.
• In-house massages, team activities and a Bring Your Family to Work Day.
• Modern Sydney CBD office, learning and growth opportunities, and an Employee Assistance Program.