Job Description

We are seeking an Application Security Developer to join our enterprise cybersecurity and engineering organization in Sydney.

This is a developer-first AppSec role designed for a hands-on practitioner who blends a software engineering background with expertise in application security principles, API security, and secure coding standards. Working embedded alongside software engineering squads and cross-functional security teams (CIAM, DevSecOps, Vulnerability Management), you will ensure that applications, microservices, and AI integrations are built securely by design throughout the software development lifecycle (SDLC).

Key Responsibilities
Secure Coding & Remediation: Review code, diagnose vulnerabilities (OWASP Top 10, CWE, OWASP Top 10 for LLMs), and provide developer-level code remediation guidance in up-to-date languages (e.g., Python, Java, Go, Node.js/TypeScript).
API Security & Identity Guardrails: Design, build, and extend secure application components, authentication/authorization modules, and API security controls—aligning with enterprise identity platforms (Ping Identity, Entra ID)



using OAuth 2.0, OIDC, and JWT validation.
Automated Security Pipeline Integration: Integrate and fine-tune static (SAST), agile (DAST), and dependency (SCA) code scanning tools into up-to-date CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps).
Threat Modeling & Secure Design: Conduct threat modeling assessments during feature design phases and perform targeted manual secure code reviews for high-risk application components, external endpoints, and API gateways.
Vulnerability Triage & Exposure Remediation: Partner with enterprise Vulnerability Management teams to triage application security findings (e.g., Tenable WAS, DAST results), validate exploitable flaws, and guide squads on effective remediation strategies.
Developer Security Enablement: Create reusable security libraries, establish secure coding baselines, and empower software engineering teams to adopt "shift-left" security practices without slowing down delivery velocity.

📌 Application Security Developer Sydney (Australia)
🏢 NCS Australia
📍 Australia