x15ventures operates in the space between corporate and startup. We help build and scale digital ventures, giving teams the freedom to move quickly while maintaining the security, safety and resilience expected of businesses connected to CommBank.

We work across x15 and its portfolio of ventures, partnering with product and engineering teams to understand their risks and build practical security controls into their technology and ways of working.

Where do you fit? As a Senior Security Engineer, you will help design, build and improve security capabilities across x15 and its ventures.

This is a hands-on engineering role with a solid focus on DevSecOps, cloud security, identity and automation. You will work closely with software engineers, platform teams and venture leaders to embed security into delivery pipelines, cloud environments and day-to-day engineering practices.

You will also mentor other engineers, contribute to technical standards and help lift security capability across the broader x15 community.

In this role, you will DevSecOps and secure delivery

Design and implement security capabilities within CI/CD pipelines, including code, dependency, secrets, container and infrastructure-as-code scanning.

Help teams interpret security findings, prioritise material issues and remediate vulnerabilities without creating unnecessary delivery friction.

Develop reusable pipeline components, guardrails and secure engineering patterns that can be adopted across multiple ventures.

Implement policy-as-code and automated compliance checks where these provide a practical and reliable alternative to manual review.

Contribute to secure coding practices, threat modelling and technical security reviews for new products,



services and material changes.

Design, implement and improve security controls across AWS and Azure environments.

Review cloud architectures and configurations, identifying risks relating to identity, networking, data protection, logging, workload security and resilience.

Help ventures implement secure cloud foundations and preventative guardrails using infrastructure as code and native cloud capabilities.

Work with engineering teams to secure containers, serverless workloads, APIs, data platforms and other cloud-native services.

Support the implementation and tuning of capabilities such as AWS CloudTrail, GuardDuty, Security Hub, Config and Azure Policy, Defender for Cloud and related services.

Identity and Microsoft security

Help design and improve identity and access controls using Microsoft Entra ID and associated identity governance capabilities.

Implement and review controls including Conditional Access, Privileged Identity Management, access reviews, workload identities, application registrations and enterprise application permissions.

Configure, integrate and improve capabilities across the Microsoft Defender suite, including Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud.





Investigate security alerts and work with relevant teams to improve detection quality, coverage and automated response.

Automation and security operations

Build automation that reduces repetitive security work and enables the small Security team to operate effectively across multiple ventures.

Develop scripts, integrations and workflows using languages and tools such as Python, PowerShell, APIs, serverless functions and workflow automation platforms.

Automate security monitoring, evidence collection, vulnerability management, control validation and response activities where appropriate.

Contribute to detection engineering, security monitoring and incident response across cloud, identity, endpoint and application environments.

Support the investigation of security incidents and help identify root causes and longer-term control improvements.

Advisory and venture partnership

Provide practical security advice to venture product, engineering and leadership teams.

Recommend proportionate controls that consider the nature of the risk, venture maturity, customer experience and delivery constraints.

Conduct technical security assessments and support ventures to develop prioritised remediation plans.

Constructively challenge designs or decisions where material security risks have not been adequately addressed.

Work with CommBank security and technology teams where ventures rely on Group platforms, services or security capabilities.

Technical leadership and mentoring

Mentor security engineers and other technical team members through pairing, design reviews, technical discussions and constructive feedback.

Help software and platform engineers build their security knowledg

📌 Senior Security Engineer (Sydney)
🏢 x15ventures
📍 Sydney