Job Description
Help protect technology that supports the financial wellbeing of millions of Australians.
Take ownership of high-impact application, API and platform security remediation across a contemporary technology workplace.
Sydney CBD Office Located, Hybrid Working

At Rest, we help more than 2 million Australians to build a better financial future. With around $112 billion in funds under management, we focus on delivering solid long-term outcomes for our members — from their first job through to retirement*. Your best at Rest means focusing on what matters, being trusted to get on with it, and knowing your work genuinely makes a difference. That’s how we operate every day, guided by our values: Be Daring, Keep It Simple, Take Action and Have Grit.

Join us as a API & Platform Engineer on a 12 Month Fixed Term Contract.

In this role you will own and perform risk-prioritised remediation of application code, dependency and repository security findings across API and platform engineering. Strengthen GitHub and CI/CD practices so vulnerabilities are effectively closed and recurring risks are reduced through secure controls, guardrails and engineering patterns.

Accountabilities/Responsibilities




Own and perform hands-on remediation of prioritised application code findings identified through SAST, DAST and other security tooling, and verify effective closure.
Remediate vulnerable open-source and third-party dependencies identified through SCA, including upgrades, replacement or removal, with evidence that the risk has been resolved.
Strengthen repository security by addressing exposed secrets, insecure configuration, excessive access, missing branch and pull-request protections, and unsafe workflow settings.
Partner with platform, application and product teams where remediation depends on service ownership, coordinating action and validating closure.
Improve GitHub and CI/CD security through secure repository baselines, reusable workflows, automated SAST, DAST and SCA integration, secrets protection, dependency controls and quality gates.
Identify recurring weaknesses and document practical controls, guardrails, secure engineering patterns, remediation standards, playbooks and governance evidence.
Lead platform and application security risk exemptions by assessing residual risk, documenting business justification and compensating controls, coordinating approvals, and monitoring review and expiry

📌 Api & Platform Engineer 12 Month Fixed Term Contract Sydney
🏢 Rest
📍 Sydney