{"id":3445225,"url":"https://alion.io/job/creditorwatch-staff-security-engineer-appsec","title":"Staff Security Engineer (AppSec)","company":{"id":60426,"name":"CreditorWatch","domain":"creditorwatch.com.au","url":"https://alion.io/company/creditorwatch","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":95,"open_postings":4,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":67,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":102000,"max_usd":245000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":724},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"DLP","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"OWASP","optional":false},{"name":"PKI","optional":false},{"name":"Python","optional":false},{"name":"SOC 2","optional":false},{"name":"TypeScript","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-10-29T07:40:13Z","employer_posted_date":"2026-10-29","last_verified_at":"2026-11-01T04:33:55Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Who are we?\nCreditorWatch is entering its next chapter - and it’s an exciting one.\nWe’re a leading Australian data and technology company transforming how businesses manage commercial risk, make credit decisions and improve cash flow. Since 2010, we’ve built a strong position in the market, helping thousands of businesses make smarter decisions through our data, insights and technology.\nFollowing our acquisition by global private equity firm Warburg Pincus, we have a new opportunity to build on that success and take the business to the next level. With an established platform, ambitious growth plans and plenty of opportunity ahead, we’re focused on scaling our impact and shaping what comes next.\nWe’re also proud to have been recognised as one of the AFR’s Top 10 Best Places to Work and certified by Great Place to Work across 2022-2025. For people who want to make a meaningful impact in a growing business, this is an opportunity worth exploring.\nOur Purpose\nEmpower Australian businesses to trade confidently with their customers.\nOur Mission\nWe aim to be number one in our industry by delivering unique data insights and innovative products.\nYour role & team\nWe're looking for a Staff Product Security Engineer to help shape how security engineering evolves at CreditorWatch, turning security strategy into practical controls, platforms and engineering practices.\nThis is a senior, hands-on individual contributor role where you'll tackle complex security challenges across our corporate environment, AWS cloud platforms and software supply chain. You'll work closely with Engineering, Platform, Data, IT and Risk teams to influence technical decisions early, establish secure design patterns and embed security into how we build and deliver software.\nAs a technical expert within our Security Engineering function, you'll lead complex, cross-functional initiatives, strengthen our security architecture and help engineers adopt emerging technologies, including AI, safely. You'll also provide technical guidance to security engineers and the wider Engineering group, helping us build sustainable security capabilities that protect the sensitive financial data we manage.\nLocation: Sydney CBD\nWorking arrangements: Full-time, hybrid\nReporting to: Head of Security\nWhat you'll own\nShape security engineering & architecture\nDefine and implement security standards, reference architectures and reusable guardrails across our technology environment.\nLead threat modelling, secure design reviews and risk assessments, working with teams early to build security in by default.\nDrive automation and scalable security controls, detections and evidence across our platforms.\nAct as a technical authority on complex security decisions, incidents and risk trade-offs.\nSecure our cloud & software supply chain\nDesign and implement AWS security controls across account architecture, IAM, network segmentation, workload protection and CSPM.\nStrengthen CI/CD and software supply chain security through SAST, SCA, secrets detection, IaC and container security, and build integrity.\nEmbed automated security checks and feedback loops into the SDLC, with clear ownership and remediation expectations.\nDeliver our identity and Zero Trust roadmap across SaaS, endpoints and cloud, including SSO, conditional access and privileged access.\nEnable secure AI & emerging technologies\nEstablish frameworks, guidance and tooling for the safe adoption of AI/ML capabilities across Engineering.\nDevelop security patterns for AI agents and agentic development tools, covering isolation, secrets protection, audit logging and validation of generated code.\nAssess emerging technologies and security platforms, translating new threats and opportunities into practical controls.\nDrive long-term security improvements that scale with our technology environment.\nLead through technical influence\nMentor security engineers and uplift security capability across Engineering through practical guidance, workshops and knowledge sharing.\nPartner with technical and business leaders to translate complex security risks into clear, actionable recommendations.\nContribute technical expertise to ISO 27001, SOC 2 and relevant regulatory assurance requirements, automating controls and evidence wherever possible.\nWhat success looks like in your first six months\nSecurity by design: Engineering teams engage security earlier, with clear design patterns and guardrails that make secure implementation easier.\nStronger cloud & application security: Priority risks across AWS, applications and the software supply chain are addressed through practical, scalable controls.\nAutomated security at scale: Security checks, detections and evidence are increasingly embedded into engineering workflows, reducing reliance on manual processes.\nSafer AI adoption: Engineers have practical security guidance and controls for adopting AI development tools and agentic workflows.\nClear technical direction: Security standards, architecture patterns and technical priorities provide a consistent foundation for security engineering.\nA stronger security culture: Security engineers and engineering teams are better equipped to identify risks, make informed decisions and take ownership of remediation.\nWhat you'll bring\nExperience: 6+ years of hands-on security engineering across multiple domains, ideally in a cloud-native, SaaS or financial services environment.\nCloud security: Strong AWS security experience across multi-account architecture, IAM, networking, workload hardening and native security services.\nApplication & product security: Experience with secure design reviews, threat modelling, code reviews and SAST/SCA/DAST tooling.\nSoftware supply chain: Experience securing CI/CD pipelines, infrastructure as code, containers, secrets management and build integrity.\nEngineering capability: Ability to write production-quality code in Python, Go, TypeScript or a similar language, and automate security workflows through scripting and APIs.\nEnterprise security & identity: Working knowledge of EDR, SSE/SWG, DLP, email security, IAM and Zero Trust, including OAuth, OIDC, SAML and privileged access.\nSecurity fundamentals: Applied knowledge of cryptography, PKI, TLS and data protection, alongside exposure to ISO 27001, SOC 2 and OWASP.\nTechnical leadership: Proven ability to influence senior engineers, shape security architecture and lead cross-functional initiatives through to measurable outcomes.\nCommunication & mentorship: You can explain complex security risks clearly, influence stakeholders and develop the capability of engineers around you.\nLong-term thinking: You favour sustainable, scalable security improvements over isolated fixes and are comfortable working across a broad range of technical domains.\nA note on AI\nUse it. We'd think less of you if you didn't.\nWe see AI as an opportunity to improve how we work, and we're interested in people who are already experimenting with it in practical ways.\nWrite the first draft of your application yourself, then use AI to sharpen it rather than replace your thinking. You can also expect to use AI during at least one stage of the interview process. We're interested in how you work with it, not whether you can work without it.\nThe perks? They’re pretty good\nFitness First - Access to a Fitness First Platinum gym membership to help you stay active.\nDaily Fuel - Barista-made coffee, breakfast, snacks, lunches and drinks on us. You’re welcome!\nPhone Credits - $50 per month towards your phone plan. One less bill to worry about.\nWellness Days - An additional day off each month to recharge, focus on your wellbeing or spend time on what matters outside work.\nMonthly Massages - In-house massages to work out those knots and help you reset.\nFun Stuff - From wine tasting with a sommelier and sailing to escape rooms, darts, boat days and team activities, there’s always something happening. We also host Bring Your Family to Work Day, giving the people who matter most a chance to see where you spend your working day.\nA Great Place to Work - Enjoy our state-of-the-art office space in the heart of Sydney CBD, designed to bring people together, collaborate and do great work.\nLearn & Grow - We’re big on development. With opportunities to build new skills, take on new challenges and explore career pathways, we want you to keep growing alongside the business.\nEmployee Assistance Program (EAP) - Access confidential support and resources to help you navigate personal or work-related challenges and look after your wellbeing.\nWe’re committed to you\nWe value open communication, celebrating wins and creating an inclusive workplace where everyone can thrive. We’re proud to be an equal opportunity employer and welcome people from all backgrounds.\nReady to join us? If you’re excited by the opportunity, we’d love to hear from you. Apply now.","description_format":"text","description_chars":8871,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Gym membership"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Cybersecurity","Credit Bureaus & Rating Agencies"],"lifecycle":[{"event":"open","at":"2026-10-29T07:40:13Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":67,"reasons":["conf:2","win:early"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/creditorwatch-staff-security-engineer-appsec","json_url":"https://alion.io/job/creditorwatch-staff-security-engineer-appsec.json","meta":{"generated_at":"2026-11-01T05:05:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7886,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-02T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":60426},"rest":"https://alion.io/mcp/rest/get_company?id=60426"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcreditorwatch-staff-security-engineer-appsec"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcreditorwatch-staff-security-engineer-appsec"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcreditorwatch-staff-security-engineer-appsec"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/creditorwatch-staff-security-engineer-appsec\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcreditorwatch-staff-security-engineer-appsec"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3445225}},{"tool":"search_jobs","arguments":{"company":"creditorwatch.com.au","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3445225},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}