ASX: Powering Australia's financial markets

Why join the ASX?

When you join ASX, you're joining a company with a strong purpose - to power a stronger economic future by enabling a fair and dynamic marketplace for all.

In your new role, you'll be part of a leading global securities exchange with a strong brand. We are known for being a trusted market operator and an exciting data hub.

We are more than a securities exchange!

The ASX team brings together talented people from a diverse range of disciplines.

We run critical market infrastructure, with 1 in 3 people employed within technology. Yet we have a unique complexity of roles across a range of disciplines such as operations, program delivery, financial products, investor engagement, risk and compliance.

We're proud to foster a workplace where diversity is celebrated and inclusion is part of our everyday culture. Our employee-led networks champion LGBTIQ+ inclusion, promote gender equality, accessibility and wellbeing, inspire giving and volunteering, and celebrate cultural and religious events, creating a sense of belonging for all.

As an AWEI Bronze employer and member of the Champions of Change Coalition for gender equality, we're committed to a fair and inclusive workplace where everyone can thrive.

Your Team:

The role sits within Security Operations and Engineering, part of ASX Cyber Security. The team protects ASX's technology setting by operating and engineering security capabilities across detection, response, vulnerability management and secure technology enablement.

The role will work across multiple applications and delivery teams, tailoring AppSec uplift to each team's maturity while maintaining delivery alignment and strengthening resilience across critical market infrastructure.





Conduct targeted application security reviews and AI-assisted code analysis to identify exploitable vulnerabilities and structural weaknesses across priority applications.

Prioritise, articulate and drive remediation of critical and high-severity code-level vulnerabilities in partnership with engineering teams.

Support threat modelling, secure design reviews and application security assessments for priority applications and automation workflows.

Adapt AppSec guidance to suit different engineering team maturity levels, balancing risk reduction, standardisation and delivery velocity.

Provide practical secure coding guidance, remediation patterns and code-level recommendations to accelerate effective fixes.

Raise, review or contribute to pull requests where appropriate to support timely remediation and knowledge transfer.

Help define, refine and embed security checkpoints, guardrails and automation within the SDLC and CI/CD pipelines.

Support optimisation of AppSec tooling, including SAST, DAST, SCA and related controls, so security testing is effective without unnecessarily impacting delivery velocity.

Help establish or uplift Security Champion practices across delivery teams to sustain secure coding capability after the engagement.

Produce handover documentation, reusable AppSec patterns and team enablement materials to support sustainable BAU ownership after the engagement.





Your experience and qualifications

Must have:

- Demonstrated experience in application security, secure software engineering or hands-on vulnerability remediation.
- Robust knowledge of secure coding practices, common application vulnerability classes and remediation approaches, including OWASP Top 10 risks and secure design principles.
- Experience reviewing application code and working with engineering teams to remediate vulnerabilities in modern development environments.
- Practical understanding of SDLC security controls, DevSecOps practices, CI/CD security integration and automated application security testing tools.
- Hands-on experience using AppSec tooling such as SAST, DAST, SCA, secret scanning, container or cloud security assessment tools.
- Experience working across multiple applications, platforms or delivery teams with varying levels of application security maturity.
- Ability to adapt approach based on risk, complexity and delivery context while maintaining strong stakeholder engagement.
- Ability to translate technical vulnerabilities into clear risk, priority and remediation guidance for delivery teams and stakeholders.

Nice to have:

- Relevant security certification such as CSSLP, GWAPT, GWEB, OSWE, CISSP or equivalent practical experience.
- Experience in financial services, critical infrastructure or highly regulated technology environments.
- Exposure to AI-assisted security analysis, threat modelling or secure-by-design uplift programs.
- Experience with DevOps pipelines, Java or comparable enterprise development environments.
- Experience establishing Security Champion practices, mentoring developers or uplifting secure coding capability a

#J-18808-Ljbffr

📌 Application Security Engineer (New South Wales)
🏢 ASX
📍 New South Wales