{"id":38721,"url":"https://alion.io/job/cba-senior-security-engineer-x15ventures","title":"Senior Security Engineer, x15ventures","company":{"id":186,"name":"Commonwealth Bank of Australia","domain":"commbank.com.au","url":"https://alion.io/company/commonwealth-bank-of-australia","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":99,"open_postings":49,"ghost_share":0.041,"stale_share":0.041,"repost_share":0.163,"time_to_fill_p50_days":13,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":82000,"max_usd":189000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2094},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"Bicep","optional":false},{"name":"CI/CD","optional":false},{"name":"CloudFormation","optional":false},{"name":"GitHub","optional":false},{"name":"GitHub Actions","optional":false},{"name":"GitLab CI","optional":false},{"name":"Kubernetes","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Defender for Cloud","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"OWASP","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Terraform","optional":false},{"name":"Agile","optional":true}],"status":"live","first_seen_at":"2026-08-04T00:00:00Z","employer_posted_date":"2026-09-25","last_verified_at":"2026-10-18T11:28:48Z","board_verified":true,"closed_at":null,"days_open":76,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":75},"description":"The opportunity\nWho we are\nx15ventures operates in the space between corporate and startup. We help build and scale digital ventures, giving teams the freedom to move quickly while maintaining the security, safety and resilience expected of businesses connected to CommBank.\nOur Security team is small, agile and cross-functional. We work across x15 and its portfolio of ventures, partnering with product and engineering teams to understand their risks and build practical security controls into their technology and ways of working.\nWhere do you fit?\nAs a Senior Security Engineer, you will help design, build and improve security capabilities across x15 and its ventures.\nThis is a hands-on engineering role with a strong focus on DevSecOps, cloud security, identity and automation. You will work closely with software engineers, platform teams and venture leaders to embed security into delivery pipelines, cloud environments and day-to-day engineering practices.\nYou will independently lead complex security engineering work, make sound technical decisions and take ownership of outcomes through to implementation. You will also mentor other engineers, contribute to technical standards and help lift security capability across the broader x15 community.\nWe are looking for someone who can move comfortably between building technical solutions and providing practical advice. You will need to understand the risk, explain why it matters and then help teams implement a solution that works in their environment.\nIn this role, you will\nDevSecOps and secure delivery\nPartner with engineering teams to embed security controls throughout the software development lifecycle.\n\nDesign and implement security capabilities within CI/CD pipelines, including code, dependency, secrets, container and infrastructure-as-code scanning.\n\nHelp teams interpret security findings, prioritise material issues and remediate vulnerabilities without creating unnecessary delivery friction.\n\nDevelop reusable pipeline components, guardrails and secure engineering patterns that can be adopted across multiple ventures.\n\nImplement policy-as-code and automated compliance checks where these provide a practical and reliable alternative to manual review.\n\nContribute to secure coding practices, threat modelling and technical security reviews for new products, services and material changes.\n\nCloud security\nDesign, implement and improve security controls across AWS and Azure environments.\n\nReview cloud architectures and configurations, identifying risks relating to identity, networking, data protection, logging, workload security and resilience.\n\nHelp ventures implement secure cloud foundations and preventative guardrails using infrastructure as code and native cloud capabilities.\n\nImprove visibility of cloud security posture, vulnerabilities, misconfigurations and emerging threats.\n\nWork with engineering teams to secure containers, serverless workloads, APIs, data platforms and other cloud-native services.\n\nSupport the implementation and tuning of capabilities such as AWS CloudTrail, GuardDuty, Security Hub, Config and Azure Policy, Defender for Cloud and related services.\n\nIdentity and Microsoft security\nHelp design and improve identity and access controls using Microsoft Entra ID and associated identity governance capabilities.\n\nImplement and review controls including Conditional Access, Privileged Identity Management, access reviews, workload identities, application registrations and enterprise application permissions.\n\nSupport the secure integration of cloud services, software-as-a-service platforms and venture applications with x15’s identity environment.\n\nConfigure, integrate and improve capabilities across the Microsoft Defender suite, including Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud.\n\nInvestigate security alerts and work with relevant teams to improve detection quality, coverage and automated response.\n\nAutomation and security operations\nBuild automation that reduces repetitive security work and enables the small Security team to operate effectively across multiple ventures.\n\nDevelop scripts, integrations and workflows using languages and tools such as Python, PowerShell, APIs, serverless functions and workflow automation platforms.\n\nAutomate security monitoring, evidence collection, vulnerability management, control validation and response activities where appropriate.\n\nContribute to detection engineering, security monitoring and incident response across cloud, identity, endpoint and application environments.\n\nSupport the investigation of security incidents and help identify root causes and longer-term control improvements.\n\nEnsure security automation is reliable, observable, maintainable and supported by appropriate documentation and operational ownership.\n\nAdvisory and venture partnership\nProvide practical security advice to venture product, engineering and leadership teams.\n\nTranslate technical vulnerabilities and security risks into clear business and customer impacts.\n\nRecommend proportionate controls that consider the nature of the risk, venture maturity, customer experience and delivery constraints.\n\nConduct technical security assessments and support ventures to develop prioritised remediation plans.\n\nConstructively challenge designs or decisions where material security risks have not been adequately addressed.\n\nWork with CommBank security and technology teams where ventures rely on Group platforms, services or security capabilities.\n\nTechnical leadership and mentoring\nMentor security engineers and other technical team members through pairing, design reviews, technical discussions and constructive feedback.\n\nHelp software and platform engineers build their security knowledge and take greater ownership of security within their teams.\n\nContribute to security engineering standards, patterns, playbooks and technical roadmaps.\n\nShare lessons, tools and reusable solutions across the venture portfolio.\n\nModel strong engineering practices, including testing, documentation, peer review, observability and maintainable design.\n\nContribute to a collaborative team environment where people are comfortable asking questions, challenging assumptions and learning from mistakes.\n\nWe are interested in hearing from people who have\nStrong hands-on experience in security engineering, cloud security, DevSecOps or a closely related discipline.\n\nExperience designing and implementing security controls within modern software delivery pipelines.\n\nStrong cloud security experience across AWS and Azure, with deep technical capability in at least one of these platforms.\n\nPractical experience securing cloud identity and access management, networking, workloads, data, logging and monitoring.\n\nExperience using infrastructure-as-code technologies such as Terraform, CloudFormation or Bicep.\n\nExperience with CI/CD platforms such as GitHub Actions, Azure DevOps, GitLab CI or similar technologies.\n\nExperience implementing security testing within delivery pipelines, such as static analysis, software composition analysis, secrets scanning, container scanning and infrastructure-as-code scanning.\n\nPractical knowledge of Microsoft Entra ID, including Conditional Access, privileged access, workload identities and application integrations.\n\nExperience with Microsoft Defender products, particularly Defender XDR, Defender for Endpoint or Defender for Cloud.\n\nStrong automation and scripting capability using Python, PowerShell or another suitable language.\n\nThe ability to review technical designs, identify material security risks and propose realistic solutions.\n\nExperience supporting vulnerability management, security monitoring or incident response activities.\n\nStrong written and verbal communication skills, including the ability to explain technical issues clearly to both engineering and non-technical audiences.\n\nExperience mentoring engineers and supporting the technical development of others.\n\nThe ability to work independently, manage competing priorities and operate effectively in a small team supporting several businesses.\n\nA practical mindset and the judgement to distinguish between controls that materially reduce risk and controls that primarily add process.\n\nUseful, but not essential\nExperience with Microsoft Sentinel, security orchestration and automated response.\n\nExperience building custom detections using Kusto Query Language or similar query languages.\n\nExperience with cloud security posture management, cloud workload protection or application security posture management platforms.\n\nExperience securing Kubernetes, container platforms, serverless applications and API-based architectures.\n\nFamiliarity with identity protocols such as OAuth 2.0, OpenID Connect and SAML.\n\nExperience with GitHub Advanced Security, Microsoft Defender for DevOps or similar developer security tooling.\n\nKnowledge of secure software development frameworks and standards such as the NIST Secure Software Development Framework, OWASP and the ACSC Information Security Manual.\n\nFamiliarity with the ACSC Essential Eight, NIST Cybersecurity Framework or other commonly used security frameworks.\n\nExperience working in financial services, fintech, regulated technology environments or businesses handling sensitive customer information.\n\nExperience working in startup, scale-up or product-led environments where controls need to be proportionate and adaptable.\n\nRelevant cloud or security certifications. Practical experience and demonstrated technical judgement are more important than certifications alone.\n\nWhat success looks like\nSecurity controls are embedded into engineering workflows rather than relying primarily on manual reviews.\n\nVenture teams receive clear, timely and practical security advice.\n\nMaterial cloud and identity risks are identified early and addressed before they become incidents.\n\nSecurity findings are prioritised based on risk, with clear ownership and realistic remediation plans.\n\nRepetitive security activities are automated, allowing the Security team to focus on higher-value work.\n\nSecurity tooling generates useful, actionable information rather than unnecessary noise.\n\nCommon security problems are addressed through reusable engineering patterns and guardrails.\n\nEngineers across x15 have greater confidence and capability in making secure technical decisions.\n\nOther engineers seek out this role for technical guidance, mentoring and constructive challenge.\n\nWhy join us?\nYou will work across a diverse portfolio of digital ventures, technologies and cloud environments rather than being limited to a single product or platform.\nYou will have the opportunity to build security capabilities, influence how products are engineered and see the outcomes of your work in practice.\nYou will also be part of a small Security team where you can make a visible contribution, learn across different security disciplines and help shape how security engineering operates as x15 and its ventures continue to evolve.\nIf you're already part of the Commonwealth Bank Group (including Bankwest, x15ventures), you'll need to apply through Sidekick to submit a valid application. We’re keen to support you with the next step in your career.\nWe're aware of some accessibility issues on this site, particularly for screen reader users. We want to make finding your dream job as easy as possible, so if you require additional support please contact HR Direct on 1800 989 696.\nAdvertising End Date: 08/10/2026","description_format":"text","description_chars":11548,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Commercial & Retail Banks","Mortgage Lending & Brokers","Online Brokerage & Trading Platforms"],"lifecycle":[{"event":"open","at":"2026-08-04T00:00:00Z"},{"event":"close","at":"2026-08-05T18:15:04Z"},{"event":"reopen","at":"2026-09-25T04:26:08Z"}],"visa":[],"liveness":{"score":9,"band":"cold","label":"Long shot","p_open":1,"p_active":0.308,"p_room":0.28,"age_days":74,"expected_fill_days":13,"reasons":["conf:8","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/cba-senior-security-engineer-x15ventures","json_url":"https://alion.io/job/cba-senior-security-engineer-x15ventures.json","meta":{"generated_at":"2026-10-19T03:20:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1859,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-20T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":186},"rest":"https://alion.io/mcp/rest/get_company?id=186"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcba-senior-security-engineer-x15ventures"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcba-senior-security-engineer-x15ventures"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcba-senior-security-engineer-x15ventures"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/cba-senior-security-engineer-x15ventures\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcba-senior-security-engineer-x15ventures"}]}