Are you a developer who would rather ship the security fix than file the finding? We'd love to hear from you

About Acorn

At Acorn, we are on a mission to transform the corporate learning experience. Our cutting-edge Performance Learning Management System (PLMS) software is powered by AI and designed to ensure that what people learn directly contributes to their exceptional performance in business. Corporate performance and learning needs a revolution, and Acorn is the antidote. We are the only solution that guides learners step by step to master the specific capabilities required for their roles, ultimately accelerating organisational performance.

Location

We are open to individuals based in Canberra or Sydney. This is a full-time in office role.

Role overview

This is a current, full-time Software Engineer (Security) role for someone who codes, reporting to our Director of Information Security. With government customers and SOC 2 Type II, you'll work across every product team to make the Acorn platform harder to attack and faster to fix. This is an IC3 role, which at Acorn means you're an experienced specialist and the go-to person in your domain: you operate with autonomy, make decisions within your area of expertise, recommend improvements to how we work, and mentor others without formal direct reports.

5 key capabilities

The best part… we use our Acorn software at Acorn. We believe in the power of our Managers and Staff being aligned on the 5 capabilities needed for each role, and the level that we expect for any given role, using our Acorn AI tool to streamline this consistently across our business. The 5 levels comprise Foundational, Developing, Proficient, Advanced and Expert.





Here are the 5 key capabilities for the role and the level expected to give you an idea of what the role entails

1. Application Security & Vulnerability Management

Embed secure design and manage vulnerabilities based on business risk to reduce exposure, protect customer trust, and sustain reliable software delivery.

Level - Proficient: At the proficient stage, you lead building security into design and own vulnerability triage to closure. You streamline pipelines and coach engineers. Your work shortens remediation time and reduces risk.

2. Software Engineering Excellence

Design, build, and evolve secure, scalable, and maintainable software systems to deliver dependable customer value, minimise risk, and drive measurable business outcomes.

Level - Proficient: At the proficient stage, you own design and build of reliable, scalable, secure software with clean code and tests. You improve performance and delivery, fix root causes, meet business goals.

Design secure architectures and assess threats to prioritise risks and define controls that reduce exposure and enable resilient, scalable delivery.

Level - Proficient: At the proficient stage, you lead threat modelling and shape designs. You prioritise risks, define practical controls, and work early with engineers. This reduces attack surface and speeds secure delivery.

4. Cloud, IAM & Platform Security Engineering





Design, implement and evolve cloud platform security and identity architectures to minimise risk, protect services, and enable compliant, reliable delivery.

Level - Proficient: At the proficient stage, you lead cloud security improvements. You design access and network protections, automating policy and detection with platform teams. Your work reduces risk and speeds compliant delivery.

5. Technical Leadership & Mentoring

Provide technical leadership and mentor teams in security engineering to embed secure-by-design practices that reduce risk, protect customer trust, and improve delivery outcomes.

Level - Proficient: At the proficient stage, you lead hands‑on security efforts and coach peers on complex work. You set standards, review designs and code, and ready teams for security incidents, reducing risk.

Key responsibilities

- Review pull requests for security issues and give feedback a developer can act on
- Triage and fix findings from code, dependency, container and cloud scanning at the root cause
- Threat‑model new features with the team building them, and turn the results into tests and acceptance criteria
- Build secure‑by‑default patterns the development teams reuse, in code and infrastructure: authentication, input validation, tenant isolation, secrets handling, least‑privilege access and CI security gates
- Partner with Infrastructure and development teams on shared fixes, platform changes and rollouts
- Support customer security reviews, penetration‑test remediation and incident response with evidence from the code
- Ship your own fixes and tooling in PHP, React with TypeScript and Terr

📌 Software Engineer (Sydney)
🏢 Acorn
📍 Sydney