{"id":583050,"url":"https://alion.io/job/firmus-technologies-security-engineer-application","title":"Senior Security Engineer, Application","company":{"id":63306,"name":"Firmus Technologies","domain":"firmus.ai","url":"https://alion.io/company/firmus-technologies","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":87,"open_postings":3,"ghost_share":0,"stale_share":0.333,"repost_share":0,"time_to_fill_p50_days":81,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":86000,"max_usd":199000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"CVSS","optional":false},{"name":"Go","optional":false},{"name":"gRPC","optional":false},{"name":"ISO 27001","optional":false},{"name":"LLM","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"Rest API","optional":false},{"name":"SBOM","optional":false},{"name":"SOC 2","optional":false},{"name":"STRIDE","optional":false},{"name":"TypeScript","optional":false}],"status":"live","first_seen_at":"2026-09-09T23:33:47Z","employer_posted_date":"2026-09-28","last_verified_at":"2026-10-26T18:15:00Z","board_verified":true,"closed_at":null,"days_open":46,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":46},"description":"Firmus Technologies\nFirmus Technologies is a global leaderpioneering the development and operation of efficient AI infrastructure across Asia Pacific. \nFounded in Australia in 2019, our mission is to create the most efficient AI infrastructure by combining cutting-edge technology with a steadfast commitment to sustainability. \nAt Firmus, we are unique in our approach. We design, build, and operatea new class of digital infrastructure - the AI Factory. Through our model-to-grid technology approach, we have pushed the boundaries of multi-generational liquid cooling systems, energy management, AI software orchestration, and construction. For our customers, this approach allows us to make every watt count and deliver low-cost AI tokens globally. \nFirmus AI Cloud\nOur large-scale GPU cloud platform, Firmus AI Cloud, is purpose-built to deliver energy-efficient AI compute at scale to customers. \nIt empowers developers, enterprises, educational institutions, and government users to train and deploy AI models with unmatched efficiency and cost savings. With an ever-growing suite of services and applications, we are committed to delivering a cloud experience that is market-leading, proprietary, and built to scale. \nROLE SUMMARY \nFirmus Technologies is seeking a Senior Security Engineer, Application for our Engineering and Technology team. You own application security for Firmus AI Cloud and the internal software that runs it. Automation is how you scale that ownership. Customers provision GPU compute through API and console, software engineers build against it, and our operators run the platform through the same control plane. You own the security of that software: the public APIs, the services behind them, how tenants stay separated inside the application, and the AI assistants and agents we ship on top. \nKEY RESPONSIBILITIES \nAutomation and secure delivery \nOwn the CI/CD security gates that every production repository passes through: SAST, DAST, SCA, secrets detection, and SBOM generation. \nBuild the systems that do the repeatable work: finding triage, dependency uplift, evidence collection, and draft threat models. \nShip the secure paved roads other teams build on: reusable libraries, service templates, and developer tooling. \nWrite and review code in the services you protect, including the security-critical paths that tools miss. \nSecurity architecture and standards \nSet the application security standard and control for authentication, authorisation between services, tenant isolation at the application boundary, secret handling and logging. \nLead threat modelling and secure design review. Define what an attacker can do and what must be true before it ships. \nSet the security requirements for the AI assistants and agents we ship e.g. prompt injection, context poisoning. \nGovern which tools and tool servers our AI agents and software engineers may reach, and how those integrations are scoped, allow-listed, and audited. \nAssurance and vulnerability management \nOwn application security posture across our services: what is covered, what is open, what is accepted with a named owner and an expiry, and what is overdue. \nPrioritise fixes on exploitability and exposure alongside CVSS and hold them to the Firmus vulnerability SLAs. \nDrive remediation with the teams that own the code so issues close at the source. \nExtend SOC 2 Type 2 and ISO 27001 into the software delivery path as services and sites grow. Evidence that a control ran should be a query, not a spreadsheet exercise. \nEnablement and escalation \nCoach security champions inside each team so secure design decisions get made without waiting for you. \nProvide application-security expertise during incidents and convert recurring failure modes into gates, tests, standards, or developer tooling. \nGive engineering leadership a straight read on application risk and release readiness. Join customer conversations when the question is application security. \nSKILLS AND EXPERIENCE \nBachelor's degree in computer science or a related technical field. \n7+ years in application security, product security, or software engineering with a security focus. \nExperience securing a public cloud or multi-tenant platform with a public API. \nDeep, practical knowledge of the OWASP Top 10 and the OWASP API Security Top 10. Has threat modelled multi-tenant APIs in production: identity, authorisation between services, tenant isolation, and the ways a client abuses a published contract using STRIDE or an equivalent method, both for REST and gRPC. \nHas improved the security posture of software built by other engineering teams through standards, tooling, review, or secure-by-default patterns. \nHas owned CI/CD security gates in production (SAST, DAST, SCA, secrets detection, SBOM) and tuned them to deliver actionable findings with low false-positive rates that engineers trusted and acted upon. \nWrites production-quality code in at least one of Python, Go, or TypeScript. \nHas replaced manual security work with automation: finding triage, dependency uplift, evidence collection, or regression tests that run without someone watching them. \nHands-on with LLM-backed or agentic features: prompt injection, tool misuse, agent identity and delegated credentials, cross-tenant data leakage, and controls on generated code reaching production. Familiar with OWASP guidance for LLM and agentic applications. \nDeep practical experience with OAuth, OIDC, JWT, RBAC or ABAC, application-layer cryptography, token handling, and secrets in software. \nHas worked under SOC 2 Type 2 or ISO 27001 and can produce evidence that a control ran. \nWilling to join incident response for application and API security. \nWilling to travel overseas occasionally when the role requires it. \nClear and effective written and verbal communication in English \nBonus Points \nExperience securing AI agents, sandboxed code execution environments, or systems where AI-generated output can trigger automated actions. \nHas run a vulnerability disclosure programme. \nSecurity certifications with application-security depth, such as CSSLP or OSWE. \nLOCATION \nSingapore or Australia","description_format":"text","description_chars":6143,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Upper-Intermediate (B2)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Data Centers & Colocation","Cloud Platforms (IaaS & PaaS)","AI Compute & Inference"],"lifecycle":[{"event":"open","at":"2026-09-10T00:22:49Z"}],"visa":[],"liveness":{"score":79,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.88,"p_room":0.9,"age_days":46,"expected_fill_days":81,"reasons":["conf:1","velocity","win:mid"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/firmus-technologies-security-engineer-application","json_url":"https://alion.io/job/firmus-technologies-security-engineer-application.json","meta":{"generated_at":"2026-10-26T22:21:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30320,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":63306},"rest":"https://alion.io/mcp/rest/get_company?id=63306"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffirmus-technologies-security-engineer-application"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffirmus-technologies-security-engineer-application"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffirmus-technologies-security-engineer-application"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/firmus-technologies-security-engineer-application\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffirmus-technologies-security-engineer-application"}]}