Principal Security Engineer (Generalist)

About Us
Infosys is a global leader in next-generation digital services and consulting. Over 320,000 of our people work to amplify human potential and create the next prospect for people, businesses and communities. We enable clients in 59 countries to navigate their digital transformation. With over four decades of experience in managing the systems and workings of global enterprises, we expertly steer clients, as they navigate their digital transformation powered by cloud and AI. We enable them with an AI-first core, empower the business with agile digital at scale and drive continuous improvement with always-on learning through the transfer of digital skills, expertise, and ideas from our innovation ecosystem. We are deeply committed to being a well-governed, environmentally sustainable organization where diverse talent thrives in an inclusive workplace. Visit www.infosys.com to see how Infosys (NYSE: INFY) can help you navigate your next. Recognized as the #1 Top Employer in Australia for the second year in a row, Infosys offers a workplace where careers grow with purpose. As an AI‑first organization, we empower our people to work on next‑generation technologies, continuously learn, and create impact at scale—supported by a culture rooted in care, inclusion, and excellence. Join Infosys and be part of a culture that’s not just promised—it’s certified. #TopEmployer2026 #ThriveAtInfosys Role Description: The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.



Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including cloud security (multi-cloud), application security, identity & access management, and threat modeling. Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.

Location:
Melbourne

Salary:
AUD 150,742 – 171,215 Annual Gross Please Note:
- The above salary range is only indicative and maybe subject to suitable enhancements, based on internal company processes Flexible working arrangements (hybrid, reviewed case-by-case basis). Feel free to connect with your recruiter to learn more about how this works in practice. Roles and

Responsibilities:
1. Security Engineering, Architecture & Solution Design
- Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade,



secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.
- Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid
- and multi-cloud environments (primarily AWS and GCP/GCVE).
- Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.
- Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.
- Collaborative Threat Modeling: Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements. 2. Cybersecurity Governance, Risk Assessment & Exception Management
- Security-Based Risk Assessments: Lead and execute detailed, security-based risk assessments for critical enterprise systems, infrastructure migrations (e.g., legacy to AWS Workspaces), and external third-party integrations, ensuring risks are documented, quantified, and managed in alignment with risk appetite.
- Consulting-Led Risk-Based Control Design: Provide advisory consulting across engineering and business units to facilitate risk-proportionate control design. Shift security from a rigid

📌 Principal Security Engineer (Melbourne)
🏢 Infosys
📍 Melbourne