{"id":3513591,"url":"https://alion.io/job/humm-group-application-security-engineer","title":"Application Security Engineer","company":{"id":2192384,"name":"humm group","domain":"shophumm.com","url":"https://alion.io/company/shophumm","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Sydney, Australia"],"countries":["AU"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Azure DevOps","optional":false},{"name":"C#","optional":false},{"name":"CI/CD","optional":false},{"name":"GitHub","optional":false},{"name":"ISO 27001","optional":false},{"name":"JavaScript","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"TypeScript","optional":false},{"name":"LLM","optional":true}],"status":"live","first_seen_at":"2026-10-30T09:12:55Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-02T09:59:32Z","board_verified":true,"closed_at":null,"days_open":3,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":3},"description":"About Us\nhumm group is a diversified financial services company that provides instalment plans which enable businesses and consumers to make large purchases. humm group operates in Australia, New Zealand, Ireland, Canada and the United Kingdom. Its principal activities include Commercial Lending in Australia and New Zealand; Point of Sale Payment Plans; Australia Cards (humm ®90, Lombard and Once); and New Zealand Cards (including Farmers Finance Card, Farmers Mastercard®, Q Card, Q Mastercard® and Flight Centre Mastercard®).\nAbout the Team\nThe Security Team sits within Digital & Transformation at humm group and is responsible for protecting enterprise systems, data, customers and colleagues through effective security controls, risk management and operational discipline.\nThe team partners closely with architecture, engineering, infrastructure, service management, and business teams to strengthen security posture, support regulatory obligations and enable safe, reliable technology outcomes.\nFlexibility, accountability and collaboration are key, with team members encouraged to take ownership of security controls and contribute to continuous improvement across the technology environment.\nWhat Your Responsibilities Look Like…\nYou will embed application security across the delivery lifecycle by:\nSecure design and threat modelling: Leading secure design reviews and threat modelling for new products, platforms, APIs and third-party integrations, and providing clear, risk-based recommendations.\nSecure code review: Performing manual and tool-assisted code reviews for high-risk changes, including payment, authentication and customer data flows.\n Security testing in CI/CD: Owning and tuning application security tooling (SAST, DAST, SCA/dependency, secrets, container and infrastructure-as-code scanning) and integrating it into CI/CD pipelines with agreed quality gates.\nVulnerability / Exposure management: Triaging, risk-rating and tracking application vulnerabilities, and working with engineering teams to fix them within agreed SLAs.\nStandards and guardrails: Developing and maintaining application security standards, secure coding guidelines, reusable patterns and guardrails, including for APIs, authentication and secrets management.\nPenetration testing: Scoping, coordinating and managing penetration testing and red team engagements with external vendors and project teams, and ensuring findings are validated and closed.\nResponsible disclosure: Managing the responsible disclosure program, including intake, triage, researcher communication and remediation tracking.\nAI security: Supporting security reviews and testing of AI use cases and AI-enabled applications, including risks such as prompt injection, data leakage and insecure integrations.\n Software supply chain: Maintaining visibility of application components and third-party libraries (e.g. a software bill of materials) to support vulnerability and patch management.\nDeveloper enablement: Building secure coding capability through training, practical guidance and a network of security champions within engineering teams.\nReporting: Tracking and reporting application security metrics and risk posture to security leadership and relevant governance forums.\nAudit and compliance: Supporting audit, PCI DSS, ISO 27001 and other regulatory obligations related to application security, including evidence for secure development and testing controls.\nAbout you…\nSkills\nProven hands-on experience in application security and secure SDLC / DevSecOps practices.\nSolid understanding of web, API, mobile and cloud application security risks, including the OWASP Top 10 and OWASP API Security Top 10.\nExperience running and tuning SAST, DAST, SCA and secrets scanning tools, and integrating them into CI/CD pipelines (e.g. GitHub, Azure DevOps).\nAbility to read and review code in at least one common language (e.g. Java, C#/.NET, JavaScript/TypeScript or Python).\nAbility to perform threat modelling, secure design reviews and application security assessments, and to validate penetration test findings.\nWorking knowledge of authentication and authorisation standards (OAuth 2.0, OpenID Connect, SAML) and secure secrets management.\nExperience with cloud platforms, ideally AWS and/or Azure, including container and infrastructure-as-code security.\nAbility to explain risk clearly and work constructively with engineering teams to improve security without unnecessarily slowing delivery.\nStrong stakeholder engagement skills across security, architecture, engineering, delivery and risk teams.\nDesirable:\nExperience in financial services, payments, fintech or other regulated environments.\nKnowledge of PCI DSS v4.0.1, ISO 27001 or similar frameworks.\nExperience managing penetration testing vendors, bug bounty or responsible disclosure programs.\nExperience securing AI / LLM-enabled applications, including familiarity with the OWASP Top 10 for LLM Applications.\nExperience developing secure coding standards, reusable security patterns or application security guardrails.","description_format":"text","description_chars":5057,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Cards & Card Issuing","Business & SME Lending","Buy Now, Pay Later"],"lifecycle":[{"event":"open","at":"2026-10-30T09:12:55Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":32,"reasons":["conf:1","velocity","win:early"],"computed_at":"2026-11-02T06:13:15Z"},"pay":null,"html_url":"https://alion.io/job/humm-group-application-security-engineer","json_url":"https://alion.io/job/humm-group-application-security-engineer.json","meta":{"generated_at":"2026-11-02T12:11:21Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16704,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-03T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2192384},"rest":"https://alion.io/mcp/rest/get_company?id=2192384"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fhumm-group-application-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fhumm-group-application-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fhumm-group-application-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/humm-group-application-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fhumm-group-application-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3513591}},{"tool":"search_jobs","arguments":{"company":"shophumm.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3513591},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}