Staff Security Engineer (AppSec)

Responsibilities

You will define and implement security standards and architectures across AWS cloud platforms and the software supply chain. Additionally, you will lead cross-functional initiatives to embed security into the development lifecycle and mentor engineering teams on secure practices.

Requirements

The role requires at least 6 years of hands-on security engineering experience, particularly in cloud-native or SaaS environments. Proficiency in AWS security, secure coding practices, and the ability to influence technical stakeholders are essential.

Skills

• Security engineering
• AWS security
• Cloud security
• Application security
• Threat modelling
• Software supply chain security
• CI/CD security
• Python
• Go
• TypeScript
• Identity and access management
• Zero Trust
• Cryptography
• ISO 27001
• SOC 2
• Technical leadership

Benefits

• Fitness First gym membership
• Daily breakfast, lunch, snacks, and coffee
• Phone credits
• Wellness days
• Monthly massages
• Team activities
• Employee Assistance Program

About this role

Who are we? 👋
CreditorWatch is entering its next chapter — and it’s an exciting one.
We’re a leading Australian data and technology company transforming how businesses manage commercial risk, make credit decisions and improve cash flow. Since 2010, we’ve built a strong position in the market, helping thousands of businesses make smarter decisions through our data, insights and technology.
Following our acquisition by global private equity firm Warburg Pincus, we have a new opportunity to build on that success and take the business to the next level. With an established platform, ambitious growth plans and plenty of opportunity ahead, we’re focused on scaling our impact and shaping what comes next.
We’re also proud to have been recognised as one of the AFR’s Top 10 Best Places to Work and certified by Great Place to Work across 2022–2025. For people who want to make a meaningful impact in a growing business, this is an opportunity worth exploring.
Our Purpose
✅ Empower Australian businesses to trade confidently with their customers.
Our Mission
🏆 We aim to be number one in our industry by delivering unique data insights and innovative products.
Your role & team 🚀
We're looking for a Staff Product Security Engineer to help shape how security engineering evolves at CreditorWatch, turning security strategy into practical controls, platforms and engineering practices.
This is a senior, hands-on individual contributor role where you'll tackle complex security challenges across our corporate environment, AWS cloud platforms and software supply chain. You'll work closely with Engineering, Platform, Data, IT and Risk teams to influence technical decisions early, establish secure design patterns and embed security into how we build and deliver software.
As a technical expert within our Security Engineering function, you'll lead complex, cross-functional initiatives, strengthen our security architecture and help engineers adopt emerging technologies, including AI, safely. You'll also provide technical guidance to security engineers and the wider Engineering group, helping us build sustainable security capabilities that protect the sensitive financial data we manage.
📍 Location: Sydney CBD
💼 Working arrangements: Full-time, hybrid
🤝 Reporting to: Head of Security
What you'll own 🔍🛡️ Shape security engineering & architecture
Define and implement security standards, reference architectures and reusable guardrails across our technology environment.
Lead threat modelling, secure design reviews and risk assessments, working with teams early to build security in by default.
Drive automation and scalable security controls, detections and evidence across our platforms.
Act as a technical authority on complex security decisions, incidents and risk trade-offs.
☁️ Secure our cloud & software supply chain
Design and implement AWS security controls across account architecture, IAM, network segmentation, workload protection and CSPM.
Strengthen CI/CD and software supply chain security through SAST, SCA, secrets detection, IaC and container security, and build integrity.
Embed automated security checks and feedback loops into the SDLC, with clear ownership and remediation expectations.
Deliver our identity and Zero Trust roadmap across SaaS, endpoints and cloud, including SSO, conditional access and privileged access.
🤖 Enable secure AI & emerging technologies
Establish frameworks, guidance and tooling for the safe adoption of AI/ML capabilities across Engineering.
Develop security patterns for AI agents and agentic development tools, covering isolation, secrets protection, audit logging and validation of generated code.
Assess emerging technologies and security platforms, translating new threats and opportunities into practical controls.
Drive long-term security improvements that scale with our technology environment.
🤝 Lead through technical influence
Mentor security engineers and uplift security capability across Engineering through practical guidance, workshops and knowledge sharing.
Partner with technical and business leaders to translate complex security risks into clear, actionable recommendations.
Contribute technical expertise to ISO 27001, SOC 2 and relevant regulatory assurance requirements, automating controls and evidence wherever possible.
What success looks like in your first six months 🏁
Security by design: Engineering teams engage security earlier, with clear design patterns and guardrails that make secure implementation easier.
Stronger cloud & application security: Priority risks across AWS, applications and the software supply chain are addressed through practical, scalable controls.
Automated security at scale: Security checks, detections and evidence are increasingly embedded into engineering workflows, reducing reliance on manual processes.
Safer AI adoption: Engineers have practical security guidance and controls for adopting AI development tools and agentic workflows.
Clear technical direction: Security standards, architecture patterns and technical priorities provide a consistent foundation for security engineering.
A stronger security culture: Security engineers and engineering teams are better equipped to identify risks, make informed decisions and take ownership of remediation.
What you'll bring 🧠
Experience: 6+ years of hands-on security engineering across multiple domains, ideally in a cloud-native, SaaS or financial services environment.
Cloud security: Strong AWS security experience across multi-account architecture, IAM, networking, workload hardening and native security services.
Application & product security: Experience with secure design reviews, threat modelling, code reviews and SAST/SCA/DAST tooling.
Software supply chain: Experience securing CI/CD pipelines, infrastructure as code, containers, secrets management and build integrity.
Engineering capability: Ability to write production-quality code in Python, Go, TypeScript or a similar language, and automate sec...

About CreditorWatch

Financial Services · 201-500 employees · headquartered in Sydney, New South Wales · founded 2010