Position: Principal Security Engineer (Generalist)

Location: Melbourne, VIC

Duration: 6+ months

Experience / Level

15+ yrs security practitioner (Senior)

Role Overview

Position Title: Principal Security Engineer (Generalist)

Location: Flexible / Hybrid

Role Purpose The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.

Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including cloud security (multi-cloud), application security, identity & access management, and threat modeling.

Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230) and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.

1. Security Engineering, Architecture & Solution Design

Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.

Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).

Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.

Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.

Collaborative Threat Modeling: Lead architectural reviews and threat modeling sessions for high-risk, complex enterprise applications and integration patterns, converting threats into clear, actionable engineering requirements.

2. Cybersecurity Governance, Risk Assessment & Exception Management

Security-Based Risk Assessments: Lead and execute detailed, security-based risk assessments for critical enterprise systems, infrastructure migrations (e.g., legacy to AWS Workspaces), and external third-party integrations, ensuring risks are documented, quantified, and managed in alignment with risk appetite.

Consulting-Led Risk-Based Control Design: Provide advisory consulting across engineering and business units to facilitate risk-proportionate control design. Shift security from a rigid checklist exercise to a dynamic, risk-based modeling framework that secures the business without slowing delivery.





Control Definition & Baselines: Establish, review, and maintain the organization's technical security "Non-Negotiables" and baseline security controls.

Pragmatic Risk & Exception Management: Lead the technical security exception and risk acceptance workflows. Partner collaboratively with business and technology stakeholders to design, validate, and document robust compensating controls when standard security patterns cannot be met.

Governance Representation: Act as the premier technical security representative on risk and governance forums, providing objective, risk-based assessments that balance business agility with the bank's defined risk appetite.

Data Classification & Lifecycle Governance: Ensure all designs, risk assessments, and patterns adhere strictly to internal data classification frameworks (C1–C4), ensuring appropriate security controls are mapped directly to data sensitivity.

3. Regulatory Compliance & Data Privacy

Regulatory Alignment: Ensure all security engineering designs, patterns, and integrations align with critical Australian prudential standards, specifically APRA CPS 234 (Information Security) and APRA CPS 230 (Operational Resilience).

Data Residency & Sovereignty: Design, validate, and enforce technical controls governing data residency, sovereignty, cross-border data transfers, and compliance with the Privacy Act 1988 (including OAIC and ATO mandates).

Third-Party Risk Mitigation: Evaluate and design secure integration patterns for external third-party SaaS, PaaS, and partner integrations, validating that external systems meet stringent organizational security and data protection standards.

4. Technical Leadership, OKRs & Culture

Strategic Execution: Translate cybersecurity strategic "Must Wins" and key Objectives & Key Results (OKRs) into tangible, pragmatic technical deliverables for delivery and platform engineering teams.

Community & Mentorship: Drive and cultivate a vibrant security champion community. Mentor mid-level and senior engineers to elevate collective security engineering capability across the organization.

Security Evangelism: Act as an advocate for secure coding practices, Infrastructure as Code (IaC) security, and general security awareness across blended, cross-functional agile teams.

5. Identity, Access & Platform Governance

Access Control Patterns: Define and govern modern, secure access patterns—including federated identity (SAML, OAuth 2.0), single sign-on (SSO), and privileged access management (PAM)—across cloud systems, analytics platforms (e.g., PowerBI), and corporate directories.

Identity Lifecycle Automation: Guide the technical implementation of automated user provisioning, de-provisioning, and regular access attestation flows, ensuring strict adherence to the principle of least privilege.

Endpoint & Mobile Security Policy: Partner in refining MDM (Mobile Device Management) and BYOD (Bring Your Own Device) security baselines to prevent data leakage while maintaining compliance with relevant financial and privacy regulations.

Key Relationships

Internal

Chief Information Security Officer (CISO)



& Security Leadership Team

Cyber Security Extended Leadership Team

Engineering Manager

Enterprise & Solution Architects

DevOps, Platform Engineering, and Cloud Infrastructure Teams

Risk, Compliance, and Internal Audit Teams

Blended Product Delivery Teams

External

Security partners, SaaS vendors, and external assessors/auditors

Technical Experience

Broad Security Domain Expertise: Extensive, hands-on experience spanning multiple security disciplines, such as Cloud Security, Application Security (AppSec), Identity & Access Management (IAM), Network Security, and GRC.

Multi-Cloud Expertise: Proven track record in securing enterprise workloads across hybrid cloud architectures, with deep exposure to AWS and/or Google Cloud Platform (GCP/GCVE).

Infrastructure as Code (IaC) & Automation: Strong expertise in securing IaC and configuration management frameworks (e.g., Terraform, Ansible) to enforce compliance-as-code.

Secure SDLC & DevSecOps: Deep understanding of modern CI/CD pipelines, containerization (Docker, Kubernetes), and the automated integration/orchestration of security testing tools (SAST, DAST, SCA, secrets detection).

Modern Identity & Directory Services: Strong knowledge of federated identity, directory integrations, and securing external/guest user access within Microsoft Entra ID (Azure AD), Okta, or similar Identity Providers.

Regulatory, Risk & Consulting Acumen

Solid Risk Management Capability: Proven ability to identify, analyze, and manage information security and operational risks. Hands-on experience designing and executing comprehensive security-based risk assessments.

Consulting-Led Control Design: Strong understanding of consulting-led, risk-based control design. Demonstrated ability to partner with delivery teams to understand their business constraints and draft risk-proportionate, custom compensating controls rather than enforcing "one-size-fits-all" security baselines.

Regulated Financial Environments: Significant experience navigating compliance and security risk within highly regulated sectors (Banking and Financial Services preferred).

Regulatory Frameworks: Practical working knowledge of Australian regulatory and compliance frameworks, including APRA CPS 234 (Information Security), APRA CPS 230 (Operational Resilience), ISO 27001, NIST CSF, the Essential Eight, and the Privacy Act 1988.

Pragmatic Risk Balancing: Demonstrated capability to translate complex compliance requirements into workable, risk-reducing technical controls without stalling development velocity.

Leadership & Soft Skills

Influencing Without Authority: Exceptional communication, storytelling, and interpersonal skills. Proven ability to act as a consultative advisory partner, influencing developers, platform engineers, and senior business executives alike.

Analytical Problem Solving: Ability to synthesize highly ambiguous business requests and complex security constraints into structured, risk-mitigated technical patterns.

Adaptability: Highly comfortable navigating changing priorities and operating effectively within dynamic, "blended" cross-functional team delivery models.

Desirable Certifications (Not Mandatory)

Certified Information Systems Security Skilled (CISSP)

Certified Information Security Manager (CISM)

Certified Cloud Security Professional (CCSP)

Cloud-specific Security Certifications (e.g., AWS Certified Security - Specialty, Google Professional Cloud Security Engineer)

📌 Principal Security Engineer (Generalist) (Melbourne)
🏢 Burgeon IT Services
📍 Melbourne