Our client is a major Australian financial services organisation who is looking for a Principal Security Engineer to join its Cyber Security Advisory and Consulting Centre of Excellence.

This is a senior, high-impact role for a broad security generalist rather than a single-domain specialist. You’ll be a trusted technical authority, connecting hands‑on security engineering, modern solution architecture and risk governance across cloud, application security, identity and threat modelling. Working with product and platform teams, you’ll make sure security controls are built in by design, proportionate to risk and compliant with APRA CPS 234, CPS 230 and NIST CSF.

What you’ll do

Design secure-by-default patterns and blueprints, including Zero Trust reference architectures

Define and govern secure landing zones, network controls and configuration standards across AWS and GCP/GCVE

Set guardrails and secure usage patterns for emerging technology, including GenAI and AI-assisted coding tools

Work with DevSecOps to embed SAST, DAST, SCA, secrets detection and compliance checks into CI/CD pipelines

Lead threat modelling and architecture reviews for high‑risk applications and integrations

Run security risk assessments for critical systems, migrations and third‑party integrations

Lead security exception and risk acceptance processes, designing practical compensating controls

Represent security on risk and governance forums, balancing business speed with risk appetite

Make sure designs meet APRA CPS 234 and CPS 230,



the Privacy Act 1988 and data residency requirements

Define access patterns for federated identity, SSO and PAM, and guide identity lifecycle automation

Mentor engineers and grow a solid security champion community

What you’ll bring

15+ years as a security practitioner across cloud security, AppSec, IAM, network security and GRC

Proven experience securing hybrid and multi‑cloud workloads on AWS and/or GCP

Strong IaC security and automation skills (Terraform, Ansible) and a deep understanding of DevSecOps, containers and Kubernetes

Knowledge of federated identity and identity providers such as Microsoft Entra ID or Okta

A strong track record in security risk assessment and risk‑based control design

Significant experience in regulated environments, ideally banking and financial services

Working knowledge of APRA CPS 234, CPS 230, ISO 27001, NIST CSF, the Essential Eight and the Privacy Act

Excellent communication skills and the ability to influence engineers and executives without direct authority

CISSP, CISM, CCSP, AWS Security Specialty or Google Professional Cloud Security Engineer certifications are highly regarded

Why this role You’ll shape how security is designed and governed across a highly regulated enterprise. You’ll move security away from checklists towards practical, risk‑based engineering that helps the business deliver.

#CyberSecurity #SecurityEngineering #CloudSecurity #DevSecOps #APRA #CPS234 #RiskManagement #FinancialServices #ContractRole #Melbourne #Hiring

#J-18808-Ljbffr

📌 Principal Security Engineer (Generalist) (Melbourne)
🏢 Velqyn
📍 Melbourne