About Us: Renaissance Info Systems is a technology and digital recruitment agency, connecting contract and permanent professionals with clients across Asia-Pacific. We aim to differentiate ourselves through our level of responsiveness, and our understanding that comes from being an IT recruitment agency from the IT Industry. Our recruiters balance sophisticated and straightforward inter-personal techniques to assure a strong candidate network.

Know More: http://www.reninfo.com.au

Principal Security Engineer l Security Engineer

Location: Australia, Melbourne preferred but can be across Australia

15+ yrs security practitioner (Senior)

Role Purpose

The Principal Security Engineer (Generalist) is a high-impact, senior leadership role within the Cybersecurity Advisory and Consulting Center of Excellence (COE). Operating as a trusted technical authority, this individual bridges the gap between deep technical security engineering, modern solution architecture, and strategic risk governance.

Rather than specializing in a single silo, the successful candidate possesses a broad, holistic understanding across multiple technology and security domains—including cloud security (multi-cloud), application security, identity & access management, and threat modelling.

Central to this role is a solid risk management capability and the ability to undertake comprehensive, security-based risk assessments. As a consulting-focused Security Leader, you will drive consulting-led, risk-based control design, working collaboratively across blended product and platform teams. Your focus is to ensure that security controls are engineered-by-design, proportionate to risk, and compliant with rigorous financial regulations (such as APRA CPS 234 and CPS 230)



and global frameworks (such as NIST CSF) while actively supporting the organization's overarching business and security objectives.

1. Security Engineering, Architecture & Solution Design

Secure Patterns & Blueprints: Lead the design, implementation, and maintenance of enterprise-grade, secure-by-default design patterns and blueprints (such as Zero Trust reference architectures) to enable rapid, secure engineering across product teams.

Multi-Cloud Security: Define and govern secure landing zones, network security controls (e.g., VPC Service Controls, micro segmentation), and secure configuration standards across hybrid- and multi-cloud environments (primarily AWS and GCP/GCVE).

Technology Assessment & AI Governance: Establish security guardrails, risk assessments, and secure usage patterns for emerging technologies, including developer environments, GenAI/AI-assisted coding tools, and SaaS marketplace integrations.

Security Automation & CI/CD Guardrails: Partner with DevSecOps and Platform Engineering to automate secure "front door" and self-service delivery processes, embedding automated scanning (SAST/DAST/SCA), secrets discovery, and compliance checks into build pipelines to reduce developer friction.

Collaborative Threat Modelling: Lead architectural reviews and threat modelling sessions for high-risk, complex enterprise applications and integration patterns,



converting threats into clear, actionable engineering requirements.

2. Cybersecurity Governance, Risk Assessment & Exception Management

Security-Based Risk Assessments: Lead and execute detailed, security-based risk assessments for critical enterprise systems, infrastructure migrations (e.g., legacy to AWS Workspaces), and external third-party integrations, ensuring risks are documented, quantified, and managed in alignment with risk appetite.

Consulting-Led Risk-Based Control Design: Provide advisory consulting across engineering and business units to facilitate risk-proportionate control design. Shift security from a rigid checklist exercise to a dynamic, risk-based modelling framework that secures the business without slowing delivery.

Control Definition & Baselines: Establish, review, and maintain the organization's technical security "Non-Negotiables" and baseline security controls.

Pragmatic Risk & Exception Management: Lead the technical security exception and risk acceptance workflows. Partner collaboratively with business and technology stakeholders to design, validate, and document robust compensating controls when standard security patterns cannot be met.

Governance Representation: Act as the premier technical security representative on risk and governance forums, providing objective, risk-based assessments that balance business agility with the bank's defined risk appetite.

Data Classification & Lifecycle Governance: Ensure all designs, risk assessments, and patterns adhere strictly to internal data classification frameworks (C1–C4), ensuring appropriate security controls are mapped directly to data sensitivity.

3. Regulatory Compliance & Data Priva

📌 Principal Security Engineer l Security Engineer (Melbourne)
🏢 Renaissance InfoSystems
📍 Melbourne