Application Security Developer

We are seeking an Application Security Developer to join our enterprise cybersecurity and engineering organization in Sydney.

This is a developer-first AppSec role designed for a hands-on practitioner who blends a software engineering background with expertise in application security principles API security and secure coding standards. Working embedded alongside software engineering squads and cross-functional security teams (CIAM DevSecOps Vulnerability Management) you will ensure that applications microservices and AI integrations are built securely by design throughout the software development lifecycle (SDLC).

Key Responsibilities

• Secure Coding & Remediation: Review code diagnose vulnerabilities (OWASP Top 10 CWE OWASP Top 10 for LLMs) and provide developer-level code remediation guidance in modern languages (e.g. Python Java Go Security & Identity Guardrails: Design build and extend secure application components authentication/authorization modules and API security controlsaligning with enterprise identity platforms (Ping Identity Entra ID) using OAuth 2.0 OIDC and JWT validation.

• Automated Security Pipeline Integration: Integrate and fine-tune static (SAST) dynamic (DAST) and dependency (SCA) code scanning tools into modern CI/CD pipelines (GitHub Actions GitLab CI Azure DevOps).

• Threat Modeling & Secure Design: Conduct threat modeling assessments during feature design phases and perform targeted manual secure code reviews for high-risk application components external endpoints and API gateways.

• Vulnerability Triage & Exposure Remediation: Partner with enterprise Vulnerability Management teams to triage application security findings (e.g. Tenable WAS DAST results) validate exploitable flaws and guide squads on effective remediation strategies.

• Developer Security Enablement: Create reusable security libraries establish secure coding baselines and empower software engineering teams to adopt shift-left security practices without slowing down delivery velocity.

Qualifications :

Essential Experience:

• Software Engineering Background: Proven track record as a Software Developer or Application Security Developer writing clean production-ready code in modern development stacks (e.g. Python Java Go JavaScript/TypeScript).

• Application & API Security Mastery: Deep technical understanding of web/API security OWASP vulnerabilities cryptography and secure authentication/authorization protocols (OAuth 2.0 OIDC SAML).

• Pipeline Security & Code Scanning: Practical experience configuring tuning and embedding SAST SCA and DAST tooling (e.g. Snyk Checkmarx SonarQube Veracode OWASP ZAP) into automated CI/CD workflows.

• Threat Modeling: Practical capability in conducting threat modeling (e.g. STRIDE) and converting security risks into clear engineering user stories and backlog items.

• Location: Sydney-based (hybrid) with full Australian working rights.

Desirable:

• Exposure to secure AI/LLM integration patterns prompt security guardrails or model risk controls.

• Experience interfacing with enterprise identity platforms (e.g. Ping Identity Entra ID) or enterprise vulnerability management platforms (Tenable).

• Relevant industry certifications (CSSLP GWAPT GWEB OSCP or CASE).

Additional Information :

Why NCS

This is a place for people who like to get stuck in bring ideas to life and make things happen. Youll work alongside experienced people who care about what they do contribute to meaningful work and have the support to keep learning and grow your career.  Whether you want to deepen your expertise explore something new or take your career in a different direction theres room to make it your own.  We value Adventure Excellence Integrity Ownership and Unity - bringing curiosity collaboration and accountability to the way we work with our clients and each other.

Ready to make extraordinary happen

Wed love to hear from you.

We celebrate diversity and inclusion

We value different perspectives experiences and strengths our people bring.  Were committed to an inclusive workplace where everyone has the opportunity to contribute grow and succeed and to providing equal employment opportunities and reasonable adjustments throughout the recruitment process.

Important information

Applicants will need valid Australian work rights and may be required to undergo relevant background probity and police checks.

Agencies: NCS accepts candidate submissions only from agencies on our preferred supplier panel through the NCS Agency Portal.

Remote Work :

No

Employment Type :

Full-time