Position: Principal Security Engineer (Security Generalist)

Location: Sydney and Melbourne

Duration: 6+ months

Role Purpose The Principal Security Engineer (Security Generalist) is a high-impact, senior leadership role within the Cybersecurity team. This individual serves as a trusted technical authority, bridging the gap between deep security engineering, solution architecture, and risk governance.

As a "Security Generalist," the successful candidate possesses a broad, holistic understanding across multiple security domains—including cloud security, application security, identity & access management, and threat modeling—rather than specializing in a single silo.

The Principal

Engineer will work collaboratively across "blended" product and platform teams, ensuring that security is engineered "by design," complying with rigorous financial regulations (such as APRA CPS 234 and CPS 230), and aligning with the organization's overarching cybersecurity strategic objectives and "Must Wins."

Key Responsibilities and Accountabilities

1. Security Engineering, Architecture & Solution Design

- Secure Patterns & Blueprints: Design, build, and maintain enterprise-grade secure design patterns and blueprints that enable product teams to build secure-by-default systems.
- Technology Assessment & Enablement: Evaluate and secure emerging development technologies, including developer environments, AI-assisted coding tools, and SaaS marketplace integrations.
- Process Automation: Partner with technology teams to design and implement automated, secure "front door" and self-service processes for software delivery, reducing friction while maintaining strict security guardrails.
- Threat Modeling: Lead collaborative threat modeling sessions for high-risk, complex enterprise applications and infrastructure integrations.

2. Cybersecurity Governance & Exception Management

- Control Definition: Define and maintain the organization's technical security "Non-Negotiables" and baseline security standards.
- Pragmatic Risk Management: Lead the formal security exception and risk acceptance workflow, partnering with business units to identify, document, and validate robust compensating controls when standard patterns cannot be met.




- Governance Representation: Act as a key technical representative on security governance forums, providing technical risk assessments that balance business agility with the bank's risk appetite.

3. Regulatory Compliance & Data Privacy

- Regulatory Alignment: Ensure all security engineering designs and patterns align with critical Australian prudential standards, specifically APRA CPS 234 (Information Security) and APRA CPS 230 (Operational Resilience).
- Data Residency & Privacy: Design and validate security controls that govern data sovereignty, cross-border data transfer, and strict compliance with the Privacy Act 1988.
- Third-Party Risk Mitigation: Assess and engineer control verifications for third-party SaaS, PaaS, and external vendor integrations to protect customer and corporate data.

4. Technical Leadership, OKRs & Culture

- Strategic Alignment: Translate cybersecurity strategic "Must Wins" and Objectives & Key Results (OKRs) into actionable technical deliverables for engineering and platform teams.
- Mentorship & Community: Foster a vibrant security champion community, mentoring mid-level and senior engineers to elevate the collective technical security capability of the organization.
- Security Education: Evangelize secure coding, infrastructure-as-code practices, and overall security awareness across blended cross-functional teams.

5. Identity, Access & Platform Governance

- Access Security: Define and govern secure access patterns for cloud environments, analytics platforms (e.g., PowerBI dashboards), and guest/external user directory federations (e.g., Microsoft Entra ID).
- Identity Lifecycle: Ensure least-privilege principles are engineered into automated user provisioning and lifecycle management flows.

Key Relationships

- Internal:
- Chief Information Security Officer (CISO)



& Security Leadership Team
- Enterprise & Solution Architects
- DevOps, Platform Engineering, and Cloud Infrastructure Teams
- Risk, Compliance, and Internal Audit Teams

- Blended Product Delivery Teams

- External:
- Security partners, SaaS vendors, and external assessors/auditors

Skills, Experience & Qualifications

Technical Experience

- Broad Security Domain Expertise: Extensive hands-on experience spanning multiple security disciplines (e.g., Cloud Security, Application Security (AppSec), Identity & Access Management (IAM), Network Security, and GRC).
- Cloud Platforms: Proven track record securing hybrid cloud architectures (preferably AWS and/or Microsoft Azure).
- Infrastructure as Code (IaC): Deep familiarity with secure configuration management and IaC practices (e.g., Terraform, Ansible).
- Secure SDLC: Deep understanding of modern CI/CD pipelines, containerization (Docker, Kubernetes), and the integration of automated security testing tools (SAST, DAST, SCA).
- Modern IAM Practices: Solid knowledge of federated identity, OAuth 2.0, SAML, and securing external/guest access in Microsoft Entra ID (Azure AD) or similar IDPs.

Regulatory & Risk Acumen

- Regulated Environments: Significant experience working within highly regulated sectors (Financial Services or Banking preferred).
- Framework Familiarity: Strong working knowledge of Australian regulatory and compliance frameworks, including APRA CPS 234 , CPS 230 , ISO 27001 , NIST CSF , and the Privacy Act 1988 .

Leadership & Soft Skills

- Influencing Without Authority: Exceptional communication and interpersonal skills, with a proven ability to influence senior business stakeholders and developers alike.
- Complex Problem Solving: Ability to synthesize complex business requirements and security constraints into practical, risk-managed technical solutions.
- Adaptability: Comfortable navigating ambiguity and leading change within dynamic, fast-paced "blended" team operating models.

Desirable Certifications (Not Mandatory)

- Certified Information Systems Security Professional ( CISSP )
- Certified Information Security Manager ( CISM )

📌 Principal Security Engineer (Security Generalist) (Sydney)
🏢 Burgeon IT Services
📍 Sydney