Find it. Fix it. Ship it.

Tired of raising security findings and waiting for someone else to fix them? This role is different.

A well-established, purpose-driven organisation delivering critical digital services is looking for a hands-on Security Engineer to join its small, high-impact Information Security team. You’ll own security findings from start to finish: review the code, write the fix, deploy it and test it. Your work makes a real, visible difference.

The team
You’ll work alongside a Security Analyst, who handles triage and raises findings, and a Compliance Analyst, who manages audit and assurance. Your focus is engineering and remediation, reporting to the CISO.

What you’ll do

- Remediate application vulnerabilities hands-on, including broken access control and other OWASP Top 10 issues, working with application team leads

- Embed security into CI/CD pipelines and Infrastructure as Code

- Secure the cloud workplace, primarily AWS

- Work with the external Security Operations Centre to investigate, prioritise and respond to alerts and incidents

- Design, implement and improve controls across identity, endpoint, network, application and data security

- Automate repeatable security tasks to reduce manual effort

- Run security reviews, threat assessments and control testing for new solutions and changes

- Support ISO 27001,



audit and penetration testing activities

- Give practical, pragmatic security advice to delivery teams

What you’ll bring

- Hands-on security engineering experience, with real examples of vulnerabilities you’ve fixed yourself

- Comfort working in application code: you don’t need to be a developer, but you can find the problem and fix it

- Solid understanding of the OWASP Top 10 and secure coding practices

- Cloud security experience, with AWS highly regarded

- Scripting or automation skills (for example Python, PowerShell or Bash)

- Experience with CI/CD, Infrastructure as Code and DevSecOps practices

- Exposure to SIEM, SOC/MSSP collaboration and incident response

- Clear communication with both technical and non-technical stakeholders

- Desirable: a security certification such as Security+, SSCP, GSEC or CISSP

Why you’ll love it

- Genuine ownership and autonomy: you’re the fixer, not the ticket-raiser

- Broad, modern work across application security, cloud and DevSecOps

- Work that matters to an organisation trusted by the community

- Hybrid working in a supportive, collaborative team

Background checks apply, and the role may include occasional out-of-hours work.

Interested?
Apply now

📌 Security Engineer (AppSec / Cloud) (Melbourne)
🏢 CH.Solutions
📍 Melbourne