Staff Security Engineer in Sydney

Set security engineering direction across diverse and strategically important Group functions. Lead complex programs of work and influence senior business and technology leaders. Combine deep technical expertise with enterprise-scale architecture and security leadership.

As a Staff Security Engineer in Group Security, you will be a highly influential individual contributor who shapes security engineering and architecture outcomes across Corporate Services and other Group functions. Your coverage may span Finance, Treasury, Audit, Property, Procurement, Risk, Human Resources, Legal, Group Corporate Affairs, Technology, Strategy and Performance, and Wealth.

You will operate across organisational boundaries, leading complex programs of work with engineering, architecture, risk, security and business peers. You will provide subject-matter expertise in senior forums and regularly engage General Managers, Executive General Managers and technology leaders.

This role requires deep security engineering and architecture expertise, strong judgement and the ability to turn complex risks into clear decisions. You will influence strategic direction while remaining sufficiently connected to engineering detail to ensure recommendations are practical, scalable and suitable for a large enterprise environment.

You will also help shape the Group's approach to emerging security challenges, including artificial intelligence security, DevSecOps and the implementation of enterprise security capabilities.

Group Security is part of Technology and brings together security and resilience capabilities spanning cyber security, protective security and business resilience, fraud technology and operations, and cyber defence. The team's purpose is safeguarding a brighter future for all. We secure the bank, protect customers, build recovery capability for challenging events and create an admired place to work, while delivering best-class security outcomes through governance, protection, detection, response and recovery.

You will join the Group Security Engineering team, operating within a Secure by Design and DevSecOps model.

In this role, you will:

• Set technical direction for complex security engineering and architecture outcomes across multiple functions.
• Lead significant programs of work with security, engineering, architecture, risk and business peers.
• Provide authoritative security advice at senior business and technology forums.
• Influence General Managers, Executive General Managers and technology leaders through clear, risk-informed recommendations.
• Lead complex architecture reviews, threat assessments and security control decisions.
• Secure AI, machine learning or data platforms, including AI gateways, runtime protection or security monitoring.
• Provide technical leadership and mentorship to security engineers and practitioners, raising engineering capability and consistency across the function.
• Guide enterprise security solutions, including endpoint detection and response, security information and event management, and observability capabilities.
• Define reusable patterns, guardrails and practices that improve security outcomes at scale.

We're interested in hearing from people who:

• Are established technical leaders who can move confidently between detailed engineering discussions, enterprise architecture decisions and executive forums.
• Influence through expertise, credibility and collaboration, and take end-to-end ownership of difficult security outcomes.

You will bring:

• Deep experience across security engineering, security architecture and technical risk in large-scale, distributed enterprise environments.
• A track record of leading complex, cross-functional security programs and influencing outcomes beyond a single team or domain.
• Strong expertise in Secure by Design, threat modelling, control design and pragmatic risk-based decision-making.
• Advanced familiarity with artificial intelligence security, DevSecOps, cloud security and secure software or infrastructure delivery.
• Experience shaping or deploying enterprise capabilities such as endpoint detection and response, security information and event management and observability platforms.
• Executive stakeholder skills, including experience presenting complex technical matters to senior business and technology leaders.

At CommBank, we're committed to creating an accessible, inclusive and respectful workplace. If you require support or adjustments, please let us know. We welcome applications from people of all backgrounds and we're particularly committed to making a positive difference for Aboriginal and/or Torres Strait Islander Peoples.