Senior Security Engineer in Sydney

This is a full-time role, with hybrid working 3 days per week in-office in Sydney (Surry Hills). Everlab is an Australian healthtech startup building the platform to look after people’s health for their entire lives. It’s not just an app, it’s the infrastructure connecting every available healthcare service to give you comprehensive data on your health and provide personalised care.

We hold some of the most sensitive data there is: diagnostic radiology, pathology, and health records flowing through our ecosystem of partners and operational systems. As we scale locally and globally, keeping that data safe, and being able to prove we keep it safe, is becoming one of our most important capabilities.

About the Role: This is a hands-on role for a Senior Security Engineer who will own Everlab’s security & compliance end to end to keep us & our data secure, and be able to prove it. You are the single owner of security here, so you will set the direction and then do the work yourself or alongside our Platform and IT teams.

• Own the risk register: make it the single source of truth. Identify risks across the whole business and operational surface, assess and prioritise them by real business impact, and drive them to closure.
• Do the hands-on security work: access reviews and least-privilege, SaaS, SSO and MFA configuration, cloud (GCP) and identity hardening, plus the tooling and lightweight automation that holds it together.
• Drive cross-team fixes to completion: where a fix sits with engineering, platform or IT, you unblock it and verify it rather than handing it off and hoping.
• Own compliance: drive our ISO 27001 and GDPR programs through Vanta, keep controls and evidence current, and get us audit-ready and certified.
• Own the reactive surface: B2B vendor security questionnaires, procurement and third-party reviews, incident response, and security monitoring and alerting.
• Scale the function without scaling headcount: direct AI tooling on real security work and automate the repeatable parts for things like annual audits.

What We're Looking For:

• Hands-on security engineer: around 5+ years of security experience as an individual contributor with a broad remit across internal IT security i.e. Google workplace through to Product security.
• Strong risk judgment: you spot the risks that actually matter, prioritise by real business impact, and make defensible trade-off calls independently.
• Compliance: Make sure we're GDPR, ISO 27001 and SOC 2 compliant and set up the automations to make documentation faster each time we need it.
• Experience securing a regulated, sensitive-data environment, ideally healthcare (PHI or health data) or another regulated domain such as finance.
• Technical depth: exposure to cloud security (AWS/GCP), identity and access management, SaaS security, and application security fundamentals.
• Structural thinker: a bias toward automation and preventative controls over throwing more people at the problem.
• Autonomous operator: you work independently and drive outcomes across teams.
• Works with AI: you use AI across your work to move faster, pointing tools at real problems and improving what comes back.
• Incredible teammate: you communicate with kindness and enjoy the growth that comes from giving and receiving direct, honest feedback.
• Owner: you take the responsibility of building in regulated healthcare seriously.

Why It’s Great to Work at Everlab:

• Do work that matters: We're building the future of preventive health.
• Work-life flexibility: Hybrid working with 3 days in the office, plus flexibility to manage life beyond the 9 to 5 when it matters.
• Experience Everlab as a customer: Full access to the Everlab health program, provided after successfully passing probation.
• Share in our success: Employee Share Option Plan included as part of your total remuneration.
• People you'll love working with: A welcoming, mission-driven team of smart, thoughtful people doing meaningful work.