Job Description

- Join a purpose-led organisation where your expertise contributes to protecting member data, platforms and digital experiences.

- Twelve-month opportunity to make a visible impact while helping advance Rest's application security maturity.

- Sydney CBD Office Location, Hybrid Working

At Rest, we help more than 2 million Australians to build a better financial future. With around $112 billion in funds under management, we focus on delivering strong long-term outcomes for our members — from their first job through to retirement*. Your best at Rest means focusing on what matters, being trusted to get on with it, and knowing your work genuinely makes a difference. That’s how we operate every day, guided by our values: Be Daring, Keep It Simple, Take Action and Have Grit.

Join us as an Application Security Engineer - CTEM on a 12 Month Fixed Term Contract. This is your opportunity to make a real contribution to the financial wellbeing of millions of Australians.

About the Role

Embed within API and Platform Engineering to strengthen its mature application security and engineering practices, then scale those practices across Data Engineering, Investment Engineering and Digital Engineering. Provide risk-based cross-functional support that ensures application security findings are prioritised, remediated and tracked through to validated closure.

Accountabilities/Responsibilities





- Analyse and triage findings from SAST, DAST, SCA, secrets, API, container, infrastructure-as-code and other application security tooling, validating impact and identifying false positives, duplicates and systemic issues.
- Prioritise application security findings using severity, exploitability, asset criticality, exposure and business context, aligned to the vulnerability management process.
- Provide explicit, practical remediation guidance and maintain end-to-end traceability between source findings, remediation tickets, accountable owners, due dates, exceptions and closure evidence.
- Own and coordinate secure SDLC controls across design, development, testing, release and ongoing maintenance, including control requirements, implementation guidance, evidence expectations and effectiveness reviews.
- Govern GitHub source-control security and application security integrations, including repository baselines, access reviews, branch protection, pull-request controls, code ownership, secrets protection, scanning, status checks, ticketing and exception handling.
- Monitor and report remediation backlog health, risk and trends; escalate overdue or blocked work; validate completed remediation; update security records; and coordinate risk exemptions through approval, review and expiry.

📌 Application Security Engineer - CTEM, 12 Month Fixed Term Contract (Sydney)
🏢 Rest
📍 Sydney