12-month contract | Onsite | Melbourne

About the role

Our client is a major Australian financial services organisation who is looking for a Principal Security Engineer to join its Cyber Security Advisory and Consulting Centre of Excellence.

This is a senior, high-impact role for a broad security generalist rather than a single-domain specialist. You’ll be a trusted technical authority, connecting hands-on security engineering, contemporary solution architecture and risk governance across cloud, application security, identity and threat modelling. Working with product and platform teams, you’ll make sure security controls are built in by design, proportionate to risk and compliant with APRA CPS 234, CPS 230 and NIST CSF.

What you’ll do

- Design secure-by-default patterns and blueprints, including Zero Trust reference architectures
- Define and govern secure landing zones, network controls and configuration standards across AWS and GCP/GCVE
- Set guardrails and secure usage patterns for emerging technology, including GenAI and AI-assisted coding tools
- Work with DevSecOps to embed SAST, DAST, SCA, secrets detection and compliance checks into CI/CD pipelines
- Lead threat modelling and architecture reviews for high-risk applications and integrations
- Run security risk assessments for critical systems, migrations and third-party integrations
- Lead security exception and risk acceptance processes, designing practical compensating controls
- Represent security on risk and governance forums, balancing business speed with risk appetite
- Make sure designs meet APRA CPS 234 and CPS 230,



the Privacy Act 1988 and data residency requirements
- Define access patterns for federated identity, SSO and PAM, and guide identity lifecycle automation
- Mentor engineers and grow a strong security champion community

What you’ll bring

- 15+ years as a security practitioner across cloud security, AppSec, IAM, network security and GRC
- Proven experience securing hybrid and multi-cloud workloads on AWS and/or GCP
- Strong IaC security and automation skills (Terraform, Ansible) and a deep understanding of DevSecOps, containers and Kubernetes
- Knowledge of federated identity and identity providers such as Microsoft Entra ID or Okta
- A strong track record in security risk assessment and risk-based control design
- Significant experience in regulated environments, ideally banking and financial services
- Working knowledge of APRA CPS 234, CPS 230, ISO 27001, NIST CSF, the Essential Eight and the Privacy Act
- Excellent communication skills and the ability to influence engineers and executives without direct authority
- CISSP, CISM, CCSP, AWS Security Specialty or Google Professional Cloud Security Engineer certifications are highly regarded

Why this role

You’ll shape how security is designed and governed across a highly regulated enterprise. You’ll move security away from checklists towards practical, risk-based engineering that helps the business deliver.

If you’re a seasoned security leader who enjoys working across domains and advising at every level, apply now.

#CyberSecurity #SecurityEngineering #CloudSecurity #DevSecOps #APRA #CPS234 #RiskManagement #FinancialServices #ContractRole #Melbourne #Hiring

📌 Principal Security Engineer (Generalist) (Melbourne)
🏢 Velqyn
📍 Melbourne