Embed application security throughout the software delivery lifecycle by conducting threat modeling, secure design reviews, code reviews, vulnerability management, penetration testing, and security testing in CI/CD pipelines. Maintain application security standards, tooling, guardrails, and software supply-chain visibility. Support AI security reviews, responsible disclosure, developer training, reporting, audits, and regulatory compliance while partnering with engineering, architecture, infrastructure, and risk teams.
About Us
hummgroup is a diversified financial services company that provides instalment plans which enable businesses and consumers to make large purchases. hummgroup operates in Australia, New Zealand, Ireland, Canada and the United Kingdom. Its principal activities include Commercial Lending in Australia and New Zealand; Point of Sale Payment Plans; Australia Cards (humm®90, Lombard and Once); and New Zealand Cards (including Farmers Finance Card, Farmers Mastercard®, Q Card, Q Mastercard® and Flight Centre Mastercard®).
About the Team
The Security Team sits within Digital & Transformation at hummgroup and is responsible for protecting enterprise systems, data, customers and colleagues through effective security controls, risk management and operational discipline.
The team partners closely with architecture, engineering, infrastructure, service management, and business teams to strengthen security posture, support regulatory obligations and enable safe, reliable technology outcomes.
Flexibility, accountability and collaboration are key, with team members encouraged to take ownership of security controls and contribute to continuous improvement across the technology environment.
What Your Responsibilities Look Like…
You will embed application security across the delivery lifecycle by:
- Secure design and threat modelling: Leading secure design reviews and threat modelling for new products, platforms, APIs and third-party integrations, and providing clear, risk-based recommendations.
- Secure code review: Performing manual and tool-assisted code reviews for high-risk changes, including payment, authentication and customer data flows.
- Security testing in CI/CD: Owning and tuning application security tooling (SAST, DAST, SCA/dependency, secrets, container and infrastructure-as-code scanning) and integrating it into CI/CD pipelines with agreed quality gates.
- Vulnerability / Exposure management: Triaging, risk-rating and tracking application vulnerabilities, and working with engineering teams to fix them within agreed SLAs.
- Standards and guardrails: Developing and maintaining application security standards, secure coding guidelines, reusable patterns and guardrails, including for APIs, authentication and secrets management.
- Penetration testing: Scoping, coordinating and managing penetration testing and red team engagements with external vendors and project teams, and ensuring findings are validated and closed.
- Responsible disclosure: Managing the responsible disclosure program, including intake, triage, researcher communication and remediation tracking.
- AI security: Supporting security reviews and testing of AI use cases and AI-enabled applications, including risks such as prompt injection, data leakage and insecure integrations.
- Software supply chain: Maintaining visibility of application components and third-party libraries (e.g. a software bill of materials) to support vulnerability and patch management.
- Developer enablement: Building secure coding capability through training, practical guidance and a network of security champions within engineering teams.
- Reporting: Tracking and reporting application security metrics and risk posture to security leadership and relevant governance forums.
- Audit and compliance: Supporting audit, PCI DSS, ISO 27001 and other regulatory obligations related to application security, including evidence for secure development and testing controls.
About you…
Skills
- Proven hands-on experience in application security and secure SDLC / DevSecOps practices.
- Solid understanding of web, API, mobile and cloud application security risks, including the OWASP Top 10 and OWASP API Security Top 10.
- Experience running and tuning SAST, DAST, SCA and secrets scanning tools, and integrating them into CI/CD pipelines (e.g. GitHub, Azure DevOps).
- Ability to read and review code in at least one common language (e.g. Java, C#/.NET, JavaScript/TypeScript or Python).
- Ability to perform threat modelling, secure design reviews and application security assessments, and to validate penetration test findings.
- Working knowledge of authentication and authorisation standards (OAuth 2.0, OpenID Connect, SAML) and secure secrets management.
- Experience with cloud platforms, ideally AWS and/or Azure, including container and infrastructure-as-code security.
- Ability to explain risk clearly and work constructively with engineering teams to improve security without unnecessarily slowing delivery.
- Strong stakeholder engagement skills across security, architecture, engineering, delivery and risk teams.
Desirable:
- Experience in financial services, payments, fintech or other regulated environments.
- Knowledge of PCI DSS v4.0.1, ISO 27001 or similar frameworks.
- Experience managing penetration testing vendors, bug bounty or responsible disclosure programs.
- Experience securing AI / LLM-enabled applications, including familiarity with the OWASP Top 10 for LLM Applications.
- Experience developing secure coding standards, reusable security patterns or application security guardrails.
humm group Sydney, New South Wales, AUS Office
121 Harrington St, Sydney, New South Wales, Australia, 2000
Similar Jobs
Artificial Intelligence • Cloud • Information Technology • Consulting • Cybersecurity • Big Data Analytics
Develop and secure applications, microservices, APIs, and AI integrations throughout the SDLC. Responsibilities include secure code reviews, vulnerability remediation, API and identity security, threat modeling, CI/CD security scanning, and developer enablement. The role requires hands-on software development experience, application security expertise, and knowledge of modern authentication protocols and security tooling. It is hybrid in Sydney and requires Australian working rights.
Top Skills:
Azure DevopsCheckmarxCweDastEntra IdGithub ActionsGitlab CiGoJavaJavaScriptJwtOauth 2.0OidcOwasp Top 10Owasp ZapPing IdentityPythonSAMLSastScaSnykSonarqubeStrideTenable WasTypescriptVeracode
.png)
eCommerce • Fintech • Hardware • Payments • Software • Financial Services
Own the full outbound sales cycle for SMB merchants, from prospecting and pipeline creation through discovery, demos, negotiation, and close. Build net-new business through cold outreach, social selling, and targeted campaigns; design multi-product solutions across Square’s ecosystem; manage Salesforce forecasting; collaborate cross-functionally; and consistently achieve revenue targets.
Top Skills:
Salesforce
.png)
Artificial Intelligence • Security • Software • Analytics • Big Data Analytics
Develops and manages reseller relationships across Australia, supports channel partner onboarding, delivers online product demonstrations and webinars, drives sales through strategic partner conversations, tracks opportunities in Salesforce, and collaborates with field sales teams to maximize revenue. The role requires occasional regional travel and operates within a hybrid Sydney-based work environment.
Top Skills:
Ip Video Management SystemsSaaSSalesforce CRMVideo Surveillance Analytics
What you need to know about the Sydney Tech Scene
From opera to comedy shows, the Sydney Opera House hosts more than 1,600 performances a year, yet its entertainment sector isn't the only one taking center stage. The city's tech sector has earned a reputation as one of the fastest-growing in the region. More specifically, its IT sector stands out as the country's third-largest, growing at twice the rate of overall employment in the past decade as businesses continue to digitize their operations to stay competitive.
