Application Security Developer

NCS Group AustraliaSydneyHybridFull-time2 weeks ago

NCS Australia is seeking an Application Security Developer in Sydney to join its enterprise cybersecurity and engineering organization. This developer-first AppSec role requires a hands-on practitioner with a software engineering background and expertise in application security, API security, and secure coding. The role involves embedding with engineering squads to ensure secure-by-design applications, microservices, and AI integrations throughout the SDLC.

What you'll do

Review code, diagnose vulnerabilities (OWASP Top 10, CWE, OWASP Top 10 for LLMs), and provide developer-level code remediation guidance in modern languages (e.g., Python, Java, Go, Node.js/TypeScript).
Design, build, and extend secure application components, authentication/authorization modules, and API security controls—aligning with enterprise identity platforms (Ping Identity, Entra ID) using OAuth 2.0, OIDC, and JWT validation.
Integrate and fine-tune static (SAST), dynamic (DAST), and dependency (SCA) code scanning tools into modern CI/CD pipelines (GitHub Actions, GitLab CI, Azure DevOps).
Conduct threat modeling assessments during feature design phases and perform targeted manual secure code reviews for high-risk application components, external endpoints, and API gateways.
Partner with enterprise Vulnerability Management teams to triage application security findings (e.g., Tenable WAS, DAST results), validate exploitable flaws, and guide squads on effective remediation strategies.
Create reusable security libraries, establish secure coding baselines, and empower software engineering teams to adopt 'shift-left' security practices without slowing down delivery velocity.

What you need

Must-have

PythonJavaGoNode.jsTypeScriptOAuth 2.0OIDCSAML

Nice-to-have

AI/LLM integration patternsPrompt security guardrailsModel risk controlsPing IdentityEntra IDTenableCSSLPGWAPT

Soft skills

CollaborationCuriosityCreativityResilienceAccountability

Application SecurityAppSecCybersecuritySoftware EngineeringAPI SecurityDevSecOpsSydneyFull-timeIT Services

/What you'll do

/What you need

Must-have

Nice-to-have

Soft skills

What you'll do

What you need