Security Engineer - Application Security

About Flybuys

Flybuys stands as Australia's leading rewards program, assisting over 10 million users in gaining more value from their daily purchases. Partnering with numerous nationally recognized brands, we aim to simplify and enrich the experience for our members daily. Our achievements include winning the Canstar Blue Most Satisfied Customer award for Rewards Programs for three consecutive years: 2023, 2024, and 2025.

Our team is distributed across Australia with a flagship office in Melbourne's CBD. Embracing flexible work policies and a people-focused culture, our employees are supported to work remotely nationwide. We prioritize outcomes aligned with our core principles: Own, Act, and Inspire.

Your Team

We have cultivated a strong, diverse team and seek unique individuals who bring different perspectives to enrich our dynamic work environment.

Role Overview

The Security Engineer (Application Security) role combines practical experience in application security, DevSecOps practices, and cloud security management. You will collaborate closely with engineering units to embed security measures into software development, deployment, and maintenance across Flybuys’ technological infrastructure. This position is ideal for a candidate with a solid engineering background aiming to deepen expertise in application and cloud security while making impactful contributions from the outset.

Operating within the Cyber Security division, this role interfaces with the Application Development, Cloud, and Data teams, providing hands-on, approachable security partnership supported by senior security personnel, fostering continuous learning and growth.

Key Responsibilities

• Deploy and manage security scanning tools integrated into GitLab CI/CD pipelines.
• Optimize scanning tools to minimize false positives and enhance developer feedback.
• Create quality gates that deliver developers rapid and actionable security insights without hindrance.
• Maintain and advance security-as-code components across multiple repositories.
• Assist development teams in interpreting and correcting vulnerabilities identified through pipeline security tools.
• Evaluate and prioritize vulnerabilities reported by Wiz, AWS Inspector, Defender, SAST, and DAST solutions.
• Contextualize security findings considering asset exposure, data sensitivity, and criticality to business operations.
• Monitor remediation timelines and collaborate with teams to resolve issues within agreed service levels.
• Contribute to constructing vulnerability reports, dashboards, and metrics driving informed security decisions.
• Identify trends in recurring vulnerabilities and propose systemic remediation approaches.
• Support the execution and upkeep of security guardrails on AWS platforms.
• Review Infrastructure-as-Code scripts for security flaws or misconfigurations.
• Engage in threat modelling exercises and perform security-focused code examinations.
• Coordinate penetration testing activities, including defining scopes, tracking remediations, and validating fixes.
• Develop scripts and automation tools to reduce repetitive security tasks workload.
• Support adoption of AI/ML-assisted workflows and large language model (LLM)-based security tooling.

Required Experience and Qualifications

• Between 2 to 4 years’ experience in security engineering, DevSecOps, software development, or infrastructure roles with a clear focus or interest in security.
• Proven hands-on exposure to CI/CD pipelines including configuration, troubleshooting, and integration of security tools.
• Familiarity with AWS ecosystem, notably IAM, networking basics, compute services, and AWS security tools.
• Experience using at least one application security tool such as static/dynamic analysis, software composition analysis, infrastructure-as-code scanning, container image inspection, or secrets discovery.
• Understanding of OWASP Top 10 and prevalent web application security threats.
• Interest and some early practical experience applying AI/ML or LLM technologies to software engineering or security challenges.
• Strong communication aptitude for effectively conveying security findings and improvement recommendations to development teams.
• Additional assets: familiarity with CNAPP platforms, GitLab, container security paradigms, API security; exposure to threat modelling, AI/ML risks related to security, or secured use of LLM tools; relevant certifications or progress toward those certifications.

Benefits

• Flexible work arrangements under Flybuysflex, enabling work from anywhere focusing on outcomes.
• Two wellness leave days per annum.
• Volunteer leave opportunities.
• Continuous learning and career development programs.
• Employee discount card for Coles and Wesfarmers products.
• Comprehensive wellbeing programs addressing mental, physical, and spiritual health.
• Quarterly team-wide events and hybrid social activities.
• New employee welcome kits including merchandise.

Additional Information

At Flybuys, we champion diversity and inclusivity, ensuring every team member’s voice is heard and respected regardless of their background or lifestyle. Employment is contingent upon successful completion of a National Police Check before commencement.