Principal Product Security Engineer
Commonwealth Bank of Australia21 hours ago
Melbourne, AustraliaStaff+
Responsibilities
- Lead complex application security engagements across diverse products, platforms, and engineering teams.
- Perform advanced web application penetration testing and security assessments to identify vulnerabilities, attack paths, and business risks.
- Conduct secure code reviews across modern technology stacks and identify insecure design patterns and opportunities to strengthen controls.
- Partner with engineers, architects, and product teams to embed secure-by-design principles throughout the software development lifecycle.
- Provide guidance on application security risks, remediation strategies, and security architecture decisions.
- Lead threat modelling activities and support proactive risk mitigation during design and development.
- Develop security tooling, automation, and AI-driven capabilities to improve assessment coverage, efficiency, and scalability.
- Mentor engineers and security practitioners and help uplift offensive security, application security, and secure development capabilities.
- Contribute to product security standards, testing methodologies, secure coding practices, and security assurance processes.
- Balance security risk, customer experience, operational resilience, and delivery objectives with stakeholders.
Requirements
- Extensive experience in Application Security, Product Security, or Offensive Security, focused on web application security.
- Deep hands-on expertise in web application penetration testing, including authentication, authorization, business logic, API, and cloud-native vulnerabilities.
- Strong secure code review capabilities across modern programming languages and frameworks.
- Deep understanding of authentication and authorization mechanisms, web protocols, APIs, cloud-native architectures, and application security attack vectors.
- Experience with threat modelling, architecture reviews, penetration testing, and security assessments throughout the software development lifecycle.
- Strong understanding of secure software engineering principles, OWASP methodologies, and modern application security practices.
- Experience working with cloud platforms, CI/CD pipelines, DevSecOps practices, and infrastructure-as-code.
- Experience using automation, scripting, AI, or security tooling to scale security assurance activities.
- Strong communication, stakeholder management, mentoring, and technical leadership skills.
- Preferred experience securing Next.js, React, Node.js, Java, .NET, or Go applications; assessing GraphQL, REST APIs, microservices, and cloud-native applications; or building application security programs.
- Relevant certifications such as OSWE, OSEP, OSCP, GWAPT, GWEB, CISSP, or equivalent are desirable.
About Commonwealth Bank of Australia
Commonwealth Bank of Australia is an ASX-listed bank headquartered in Sydney that provides retail, business, and institutional banking, payments, and wealth services across Australia. Its offerings include transaction and savings accounts, home and business lending, cards, merchant services, digital banking, superannuation, and investment platforms such as CommSec. Founded in 1911, the bank serves millions of customers through branches, contact centres, and online channels.