About Linkly
Linkly is a PE-backed, Australian fintech focusing on payment integration solutions. We are a leading provider in ecommerce recurring billing, and our middleware powers over 200,000 terminals and processes over two billion transactions annually. Our applications support over 800 integrations into POS solutions. We have built our reputation through seamless integration of payment terminals and POS systems and are continuing to innovate in creating a terminal and acquirer independent payment solicitor for in-store. Our clients include major banks and retailers such as Woolworths, David Jones, JB Hi-Fi, and Bunnings.
Our goal is to continuously lead the payments industry with new technology delivering value to clients, which who include merchants, banks, acquirers and POS vendors, expanding our presence into other regions.
About the Role
We’re looking for a Principal Security Engineer to join our Security team and take ownership of developing & owning (1) data security across our product portfolio and (2) Linkly’s internal penetration testing capability, alongside our Chief Security Officer.
This is an application, cloud and data security role, focused on the products and services we build and the Azure environment they run on, rather than corporate network or IT security. It requires deep technical expertise, with Azure as our primary platform. You’ll work to help validate that the design and configuration of our products and services meet security requirements. You’ll partner with engineering from the earliest stages of design, helping shape secure solutions rather than signing them off at the end.
As a principal individual contributor, you’ll also share your expertise with the team, mentoring other engineers, including senior engineers, and helping lift security capability across the business.
Our Security team is small, which means your work won’t be limited to penetration testing or threat modelling. You’ll have the opportunity to get involved across various stages of how we secure our products and services, from early design through to ongoing operation.
This is a hybrid role working 3 days in our Sydney office.
Key Responsibilities
- Build and run Linkly’s internal penetration testing function, defining its strategy and approach and carrying out testing across our cloud infrastructure, products and services.
- Carry out penetration testing and security assessments of our Azure environment as required, including new changes to our cloud infrastructure.
- Consult with engineering teams and validate and test that the design and configuration of their products and services are secure and meet security requirements.
- Champion DevSecOps and a shift-left approach to security, educating engineering teams on secure architecture and design patterns early, so security is built in before formal review.
- Own Linkly’s security guidelines and define the security baselines our cloud environments are built and measured against.
- Lead security design review, threat modelling and access control across our products and services, working with engineering teams from early design through to ongoing operation.
- Provide security design review and testing for upcoming initiatives, including our new data product.
- Lead data security across our products and platforms, defining how sensitive and payment data is classified, protected, accessed and retained.
- Mentor other engineers in the Security team, sharing your knowledge and experience.
What You'll Need
- 8+ years’ experience as a security engineer, or security consultant.
- Proven experience developing threat models and helping engineering teams reason through different ways to reduce security risk.
- Hands-on penetration testing experience, including experience establishing and leading a penetration testing capability.
- Expert, detailed technical knowledge of Microsoft Azure, including cloud-native attack techniques and common misconfigurations.
- Proven experience with secure cloud architecture, particularly on Azure.
- Strong data security engineering expertise, including data classification, access control and protecting sensitive data in cloud environments.
- Experience with data governance or compliance frameworks, such as SOC 2 or ISO/IEC 27001.
- Strong scripting or programming skills (e.g. Python or PowerShell) to automate testing and build your own tooling.
- Ability to write clear, concise reports covering findings, risks and practical remediation recommendations.
- Experience embedding security into DevSecOps practices and CI/CD pipelines, and coaching engineers on secure-by-design principles.
- Strong communication skills, with the ability to explain technical security concepts to both technical and non-technical audiences.
Nice to Have
- Certified Ethical Hacker (CEH) or an equivalent certification.
- Exposure to PCI DSS and the payments industry.
Our Values
- Act Like an Owner: Take full accountability for outcomes and make decisions with the long-term success of Linkly in mind.
- Innovate: Challenge assumptions, champion new ideas and drive meaningful change for customers and the business.
- Deepen Trust: Build confidence through integrity, transparency and consistent delivery with your team, partners and clients.
- Care and Respect: Foster an inclusive, supportive environment where everyone feels valued and empowered to do their best work.
