This is a rare opportunity to join a high-growth, purpose-driven fintech business that is scaling with real momentum.
The technology and security function is evolving to match, and this hire is central to that journey.About the RoleThis is a hands-on, mid-level Security Engineer role sitting within a small, blended Security and IT Operations team reporting directly to the Head of Security and IT.
The team is lean by design and that means every person in it has real ownership, real variety, and real impact.You will be the go-to security SME for the business, the person who can answer 90% of security questions, make pragmatic judgements about risk, and help the broader technology team embed security into how they operate every day.
This is not a compliance reporting role.
It is an engineering and operations role for someone who wants to get in, get their hands dirty, and build something that lasts.The work you do here will form the foundation of this organisation's security posture for years to come.
The next generation of security hires will build on top of what you put in place, not reverse-engineer it.What You'll Be Working On:Acting as the in-house security SME, providing practical guidance across security operations, compliance obligations, technology change and control designLeading the triage, coordination and improvement of security incidents, working with internal teams and the external SOC and MDR partnersImproving and assuring core security controls across identity, endpoint, Microsoft 365, SaaS platforms, integrations, cloud-based systems, vulnerability management and user securitySupporting identity and access management controls including privileged access, access reviews, joiner/mover/leaver processes and MFAProviding pragmatic security input into technology change,



projects and vendor implementations so risks are identified early and controls are workableMaintaining practical standards, playbooks and runbooks so repeatable security activities can be shared across the broader operations teamSupporting vulnerability management, internal assessments, audits, third-party risk reviews, evidence collection and remediation trackingContributing to security awareness activities including training and phishing simulationsMaintaining clear security reporting across incidents, control health, vulnerabilities and compliance activityWhat We're Looking ForThe things that matter most:1.
3–5 years of hands-on experience across cyber security operations and engineering, someone who has spent their time doing, not just advising.
A diverse background across environments is valued over narrow specialism.2.
Strong M365 and modern cloud security capability, you're genuinely across Microsoft 365 security tooling, understand how to leverage Microsoft-native capabilities for security event management and compliance, and think in terms of cloud-first security architecture.3.
Zero trust understanding in practice - not just as a concept you can define, but as an architecture you can speak to, apply, and help evolve.
You'll be asked what zero trust means to you, and the answer matters.Beyond the non-negotiables,



we're also looking for:Experience working with MDR, SOC or incident response partners - managing escalations, challenging findings, and turning partner outputs into practical actionsFamiliarity with security frameworks including ACSC Essential Eight, ISO ***** and/or NIST CSFExposure to financial services or regulated environments where PII controls, audit evidence and operational discipline matterAn ISMS working knowledge - this organisation operates one and you'll need to work within itInterest in or exposure to infrastructure-as-code and automation tooling, including Terraform — the security function is heading in this direction and ambition to grow into it is valuedStrong documentation habits and a bias toward practical improvement over theoretical securitySecurity certifications are beneficial but not essential - judgement, ownership and delivery matter mostThe PersonAs importantly as anything technical, we are looking for someone who is inquisitive, pragmatic and human.
Someone who does their homework before saying no.
Someone who understands that security exists to enable the business, not obstruct it — and who can measure risk appropriately for the problem at hand rather than applying an enterprise-grade framework to every small issue.If you are someone who gets energy from building things that didn't exist before, who wants to leave a function in better shape than you found it, and who sees a small team as an chance rather than a constraint — this role was written for you.Be careful - Don't provide your bank or credit card details when applying for jobs.
Don't transfer any money or complete suspicious online surveys.
If you see something suspicious, report this job ad .
#J-*****-Ljbffr

📌 Cyber Security Engineer (Melbourne)
🏢 CH.Solutions
📍 Melbourne