Security Engineer

We Dream. We Design. We Deliver.

Join hummgroup, one of Australasia’s most successful and enduring non-bank financial services institutions. We specialise in fast, easy finance with a market-leading range of business asset finance, credit cards and point of sale payment plan solutions designed around the core needs of today’s businesses and retail consumers. Come join our team and be a part of our next chapter of innovation and growth.

About the team

The Security Team sits within Digital & Transformation at hummgroup and is responsible for protecting enterprise systems, data, customers and colleagues through effective security controls, risk management and operational discipline.

The team partners closely with architecture, engineering, infrastructure, service management, and business teams to strengthen security posture, support regulatory obligations and enable safe, reliable technology outcomes.

About the role

As Security Engineer, you will make security a built-in part of how humm group designs, builds and releases software. You will identify, prioritise and drive remediation of application security risk across our internal, customer-facing and third-party platforms.

You will work hands-on with engineering and delivery teams across the secure software development lifecycle (SSDLC), from secure design review and threat modelling, through code review and automated security testing in CI/CD pipelines, to penetration testing and vulnerability remediation.

Partnering with architecture, engineering and risk teams, you will set practical application security standards and guardrails, help teams fix issues quickly without slowing delivery, and provide the evidence needed for audit, PCI DSS and other compliance obligations.

Key Responsibilities

Key responsibilities include:

• Secure design and engineering: Lead threat modelling, secure design and code reviews across products, platforms, APIs and high-risk changes.

• Security testing and delivery: Manage application security tools, CI/CD quality gates, penetration testing and red team engagements.

• Vulnerability management: Triage, prioritise and drive remediation of application, third-party and software supply chain vulnerabilities.

• Standards and emerging risk: Maintain practical security standards and guardrails, including controls for APIs, authentication, secrets and AI-enabled solutions.

• Developer enablement: Build secure coding capability through practical guidance, training, reusable patterns and security champions.

• Risk, reporting and compliance: Provide clear security insights, manage responsible disclosure and support PCI DSS, ISO 27001 and audit obligations.

Qualifications & Experience

• 4 + years of experience in a cyber security role such as Security Analyst, Security Engineer, or similar.
• Relevant certifications and/or tertiary education, such as:
  • Security Operations, CompTIA CySA+, AWS / Microsoft security certifications or similar
  • Vendor-specific certifications for SIEM, EDR, firewalls, cloud security, or DLP.

• Experience with SIEM platforms, automation, threat hunting, and intelligence.

• Firewalls, proxies, secure web gateways, endpoint detection and response, application whitelisting, routers, switches, micro-segmentation, NDR, DLP, SSE and web application firewalls.

• Microsoft 365, AWS, Azure, Windows Server, Linux/Unix, iOS and Android.

• Web application security, vulnerability scanning, DevSecOps pipelines, penetration testing support.

• Experience with risk assessments, SOPs, playbooks, guidelines, compliance frameworks (PCI DSS, ASD Essential 8, ISO 27001, NIST).

About you

• Ability to produce clear operational-level reporting.

• Strong analytical and problem-solving mindset.
• Ability to work independently in fast-paced environments.
• Effective communicator who can simplify technical concepts for non-technical stakeholders.
• Collaborative team player committed to improving organisational security maturity.
• High levels of integrity, accountability, and attention to detail.

• Ideal for technically capable cyber security professionals, this role suits someone who thrives in fast-paced environments, enjoys solving complex security challenges, and wants their work to have real, visible impact.

Working at hummgroup

We embrace flexible working arrangements, ensuring a genuine work-life balance and a fun, vibrant inclusive culture that embraces diverse perspectives and values the unique contributions of each of our team through our behaviours Curious - Adaptable - Tenacious - Accountable - Respectful.

We invite candidates of all gender expressions, ethnicities, ages, and other culturally diverse groups to apply. We are committed to making reasonable adjustments to provide a positive, barrier-free recruitment process and welcoming and supportive environment where all our people can thrive.

If this sounds like the opportunity, you have been looking for then apply today!