Application Security Manager | Greenfield Build | Melbourne (open to other cities)

Ever wanted to build an application security function from scratch, your way?

This is a rare chance to establish a brand current AppSec team inside a large, diverse organisation. It’s a complex and highly regulated environment, but the culture is genuinely flexible, and the security function is backing in-house capability over off-the-shelf fixes.

The opportunity

Reporting to the Head of Security Engineering & Platforms as the 2ic, you’ll own the application security advisory capability. This is not a platforms or engineering-ops role: your focus is advisory, architecture and setting the direction for how applications are designed, built and secured across the business.

This is a excellent opportunity for an application security engineer or lead to step up into a management role. You’ll lead a small team including a Cyber Security Architect and Application Security Engineers.

What you’ll be doing

- Building the AppSec function from the ground up, including standards, patterns, control requirements and assurance processes
- Owning security architecture input and secure-by-design practices across application delivery
- Embedding DevSecOps practices into delivery pipelines where they make sense
- Leading application risk assessments, design reviews and threat modelling, plus oversight of security testing and remediation
- Working closely with delivery teams, architects, risk, technology and strategic partners to lift application security posture




- Reporting on application risk, control gaps, remediation progress and capability maturity

What we’re looking for

- Solid application security background, with hands-on experience in secure design reviews, threat modelling, security testing and vulnerability remediation
- A builder’s mindset: comfortable with ambiguity and excited by creating something new rather than maintaining something established
- Curiosity and willingness to learn. Attitude and capability matter more than a perfect checklist
- Strong communication skills and the ability to influence both technical and business stakeholders

On tooling The team is tool-agnostic. Modern AppSec platforms are being explored, but what you bring to the table matters far more than which tools you’ve used. You’ll have real input into the approach. Why this role?

- Genuinely greenfield work, with your fingerprints on the function from day one
- A step into leadership with the scope and backing to shape a capability
- Varied, meaningful environment across critical infrastructure and essential services
- Super flexible working: 2-3 days in the office, with Tuesday as the team anchor day

If you’re an AppSec Engineer, Lead or Manager who wants to build rather than inherit, apply now or reach out to Jas McCrudden at Decipher Bureau for a confidential chat. How to apply: Click apply or submit your CV to [email protected] or [email protected] for a 100% confidential, informal conversation where your privacy will absolutely be respected.

📌 Application Security Manager (Melbourne)
🏢 Decipher Bureau
📍 Melbourne