About Us: Infosys is a global leader in next-generation digital services and consulting. Over 320,000 of our people work to amplify human potential and create the next opportunity for people, businesses and communities. We enable clients in 59 countries to navigate their digital transformation.

With over four decades of experience in managing the systems and workings of global enterprises, we expertly steer clients, as they navigate their digital transformation powered by cloud and AI. We enable them with an AI-first core, empower the business with agile digital at scale and drive continuous improvement with always-on learning through the transfer of digital skills, expertise, and ideas from our innovation ecosystem. We are deeply committed to being a well-governed, environmentally sustainable organization where diverse talent thrives in an inclusive workplace.

Visit www.infosys.com to see how Infosys (NYSE: INFY) can help you navigate your next.

Recognized as the #1 Top Employerin Australia for the second year in a row, Infosys offers a workplace where careers grow with purpose. As an AI‑first organization, we empower our people to work on next‑generation technologies, continuously learn, and create impact at scale—supported by a culture rooted in care, inclusion, and excellence.

▶️Join Infosys and be part of a culture that’s not just promised—it’s certified. #TopEmployer2026 #ThriveAtInfosys

Role Description: The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.

Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including cloud security (multi-cloud), application security, identity & access management, and threat modeling.

Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.

Location: Melbourne

Salary: AUD 150,742– 171,215 Annual Gross

Please Note

- The above salary range is only indicative and maybe subject to suitable enhancements, based on internal company processes

Flexible working arrangements (hybrid, reviewed case-by-case basis). Feel free to connect with your recruiter to learn more about how this works in practice.

Roles and Responsibilities:

1.

Security

Engineering, Architecture &

- Solution Design

- Secure Patterns & • Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.

- Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).
- Technology Assessment & • AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.

- Security Automation & • CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.

- Cooperative Threat Modeling: Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements.

2.

Cybersecurity

Governance, Risk Assessment &
- Exception Management

- Security-Based Risk Assessments: Lead and execute detailed, security-based risk assessments for critical enterprise systems, infrastructure migrations (e.g., legacy to AWS Workspaces),



and external third-party integrations, ensuring risks are documented, quantified, and managed in alignment with risk appetite.
- Consulting-Led Risk-Based Control Design: Provide advisory consulting across engineering and business units to facilitate risk-proportionate control design. Shift security from a rigid checklist exercise to a dynamic, risk-based modeling framework that secures the business without slowing delivery.
- Control Definition & • Baselines: Establish, review, and maintain the organization's technical security "Non-Negotiables" and baseline security controls.

- Pragmatic Risk & • Exception Management: Lead the technical security exception and risk acceptance workflows. Partner collaboratively with business and technology stakeholders to design, validate, and document robust compensating controls when standard security patterns cannot be met.

- Governance Representation: Act as the premier technical security representative on risk and governance forums, providing objective, risk-based assessments that balance business agility with the bank's defined risk appetite.
- Data Classification & • Lifecycle Governance: Ensure all designs, risk assessments, and patterns adhere strictly to internal data classification frameworks (C1–C4), ensuring appropriate security controls are mapped directly to data sensitivity.

3.

Regulatory

Compliance & Data Privacy

- Regulatory Alignment: Ensure all security engineering designs, patterns, and integrations align with critical Australian prudential standards, specifically APRA CPS 234 (Information Security) and APRA CPS 230 (Operational Resilience).
- Data Residency & Sovereignty: Design, validate, and enforce technical controls governing data residency, sovereignty, cross-border data transfers, and compliance with the Privacy Act 1988 (including OAIC and ATO mandates).
- Third-Party Risk Mitigation: Evaluate and design secure integration patterns for external third-party SaaS, PaaS, and partner integrations, validating that external systems meet stringent organizational security and data protection standards.

4.

Technical

Leadership, OKRs &
- Culture

- Strategic Execution: Translate cybersecurity strategic "Must Wins" and key Objectives & • Key Results (OKRs) into tangible, pragmatic technical deliverables for delivery and platform engineering teams.

- Community & • Mentorship: Drive and cultivate a vibrant security champion community. Mentor mid-level and senior engineers to elevate collective security engineering capability across the organization.

- Security Evangelism: Act as an advocate for secure coding practices, Infrastructure as Code (IaC) security, and general security awareness across blended, cross-functional agile teams.

5. Identity, Access & • Platform Governance

- Access Control Patterns: Define and govern modern, secure access patterns—including federated identity (SAML, OAuth 2.0), single sign-on (SSO), and privileged access management (PAM)—across cloud systems, analytics platforms (e.g., PowerBI), and corporate directories.
- Identity Lifecycle Automation: Guide the technical implementation of automated user provisioning, de-provisioning, and regular access attestation flows, ensuring strict adherence to the principle of least privilege.
- Endpoint & • Mobile Security Policy: Partner in refining MDM (Mobile Device Management) and BYOD (Bring Your Own Device) security baselines to prevent data leakage while maintaining compliance with relevant financial and privacy regulations.

Technical Expertise & other qualifications (Essential)

Technical Experience

- Broad Security Domain Expertise: Extensive, hands-on experience spanning multiple security disciplines, such as Cloud Security, Application Security (AppSec), Identity & • Access Management (IAM), Network Security, and GRC.

- Multi-Cloud Expertise: Proven track record in securing enterprise workloads across hybrid cloud architectures, with deep exposure to AWS and/or Google Cloud Platform (GCP/GCVE).
- Infrastructure as Code (IaC) & • Automation: Strong expertise in securing IaC and configuration management frameworks (e.g., Terraform, Ansible) to enforce compliance-as-code.

- Secure SDLC & • DevSecOps: Deep understanding of modern CI/CD pipelines, containerization (Docker,



Kubernetes), and the automated integration/orchestration of security testing tools (SAST, DAST, SCA, secrets detection).

- Modern Identity & • Directory Services: Strong knowledge of federated identity, directory integrations, and securing external/guest user access within Microsoft Entra ID (Azure AD), Okta, or similar Identity Providers.

Regulatory, Risk & • Consulting Acumen

- Solid Risk Management Capability: Proven ability to identify, analyze, and manage information security and operational risks. Hands-on experience designing and executing comprehensive security-based risk assessments.
- Consulting-Led Control Design: Strong understanding of consulting-led, risk-based control design. Demonstrated ability to partner with delivery teams to understand their business constraints and draft risk-proportionate, custom compensating controls rather than enforcing "one-size-fits-all" security baselines.
- Regulated Financial Environments: Significant experience navigating compliance and security risk within highly regulated sectors (Banking and Financial Services preferred).
- Regulatory Frameworks: Practical working knowledge of Australian regulatory and compliance frameworks, including APRA CPS 234 (Information Security), APRA CPS 230 (Operational Resilience), ISO 27001, NIST CSF, the Essential Eight, and the Privacy Act 1988.
- Pragmatic Risk Balancing: Demonstrated capability to translate complex compliance requirements into workable, risk-reducing technical controls without stalling development velocity.

Leadership &

• Soft Skills

- Influencing Without Authority: Exceptional communication, storytelling, and interpersonal skills. Proven ability to act as a consultative advisory partner, influencing developers, platform engineers, and senior business executives alike.
- Analytical Problem Solving: Ability to synthesize highly ambiguous business requests and complex security constraints into structured, risk-mitigated technical patterns.
- Adaptability: Highly comfortable navigating changing priorities and operating effectively within dynamic, "blended" cross-functional team delivery models.

Desirable Certifications (Not Mandatory)

- Certified Information Systems Security Professional (CISSP)
- Certified Information Security Manager (CISM)
- Certified Cloud Security Professional (CCSP)
- Cloud-specific Security Certifications (e.g., AWS Certified Security - Specialty, Google Professional Cloud Security Engineer)

- ADDITIONAL

1. Excellent customer-facing skills
2. Excellent written and verbal communication skills
3. Strong attention to detail and outstanding analytical and problem-solving skills.

In addition to compensation aligned with your role, you’ll have access to a wide range of benefits that support your health, career growth, and overall well-being (AU)

- Income Protection Insurance
- Paid Parental and Volunteer leaves
- Employee Assistance Program (EAP)
- Flexible working arrangements (hybrid, reviewed case-by-case basis)
- Health Insurance Discount and Well-being Program
- Access to Fitness and Gym Memberships
- Salary packaging and novated leasing

Our recruitment and selection process is designed to create the best match for both you and Infosys. Depending on the role, it may include an initial screening, technical or functional interviews, and conversations focused on cultural alignment and shared values.

We are committed to making the experience transparent, respectful, and engaging at every step. Hear from our recruiter on their experience working with Infosys as an Employer

At Infosys, we recognize that everyone has individual requirements. If you are a person with disability, illness, or injury and require adjustments to the recruitment and selection process, please contact our Recruitment team for adjustment either via the following email [email protected] or call 1-(phone hidden). Alternatively, you can include your preferred method of communication in email, and someone will be in touch.

Please note in order to protect the interest of all parties involved in the recruitment process, Infosys does not accept any unsolicited resumes from third-party vendors. In the absence of a signed agreement, any submission will be deemed as non-binding and Infosys explicitly reserves the right to pursue and hire the submitted profile. All recruitment activity must be coordinated through the Talent Acquisition department.

“All aspects of employment at Infosys are based on merit, competence and performance. We are committed to embracing diversity and creating an inclusive environment for all employees. Infosys is proud to be an equal opportunity employer.”

📌 Principal Consultant (Victoria)
🏢 Infosys
📍 Victoria