Staff Security Engineer

About the role

CommBank is looking for a Staff Security Engineer in its Group Security team, which sits within Technology and covers cyber security, protective security, business resilience, fraud technology and operations, and cyber defence. The role sets security engineering and architecture direction across Corporate Services and other Group functions, working with Finance, Treasury, Audit, Property, Procurement, Risk, Human Resources, Legal, Group Corporate Affairs, Technology, Strategy and Performance, and Wealth. It is a senior individual contributor position.

Key responsibilities

• Set technical direction for complex security engineering and architecture outcomes across multiple functions
• Lead significant programs of work with security, engineering, architecture, risk and business peers
• Provide authoritative security advice at senior business and technology forums and influence General Managers, Executive General Managers and technology leaders
• Lead complex architecture reviews, threat assessments and security control decisions
• Help shape the Group's approach to emerging security challenges such as AI security, DevSecOps and enterprise security capabilities
• Mentor security engineers and practitioners and raise engineering capability and consistency
• Guide enterprise security solutions such as endpoint detection and response, SIEM and observability platforms
• Define reusable patterns, guardrails and practices that improve security outcomes at scale

Required profile

• Established technical leader able to move between detailed engineering, enterprise architecture and executive forums
• Track record of leading complex, cross-functional security programs and influencing outcomes beyond a single team
• Experience presenting complex technical matters to senior business and technology leaders
• Ability to turn complex risks into clear, practical and scalable decisions

Required skills

• Deep experience in security engineering, security architecture and technical risk in large-scale, distributed enterprises
• Secure by Design, threat modelling, control design and risk-based decision-making
• AI security, DevSecOps, cloud security and secure software or infrastructure delivery
• Endpoint detection and response, SIEM and observability platforms