Security Engineers - Senior Analyst / Manager

Description

The Cyber and Digital Trust team supports major technology transformation programmes and helps clients build secure, trusted business and technology solutions.

The company is adding Security Engineers to add delivery capacity in three specialist areas: Salesforce security, integration security, and web and forms security.

These are hands-on engineering roles embedded in large programmes, working with Security Architects and wider delivery teams on triage, risk assessment, solution design, security by design, development support and assurance.

You will apply security principles to business and technology solutions, help development teams find and fix security risks early, and provide clear evidence that agreed controls work as intended.

Specialist focus areas may include Salesforce access control, sharing and permission models, Shield, platform encryption, Apex, Lightning Web Components, flows and Experience Cloud; MuleSoft or similar integration platforms, API security, OAuth2, OpenID Connect, mTLS, gateway policies, service identities and secrets management; and Salesforce or Adobe Experience Manager forms, input validation, output encoding, file uploads, session management and handling of personal and sensitive information.

Growth opportunities include a global network, leadership development, A.I. tools and training, and formal learning pathways.

The company is known for shaping the future of business, and the work involves helping clients and communities solve important problems.

Responsibilities

• Provide hands-on security engineering support across triage, risk assessment, control design, development support and assurance.
• Guide developers, platform teams and product owners to build security into delivery from the start.
• Review solution designs, user stories, configurations, API specifications, forms, data flows and code changes to find security and privacy risks.
• Turn security requirements into practical implementation guidance for technical and non-technical stakeholders.
• Produce clear documentation, control evidence, implementation guidance and assurance material.
• Support security testing, vulnerability remediation, control validation and certification and accreditation evidence where needed.
• Escalate significant design decisions and programme-level risks to Security Architects.

Requirements

• Around 4 to 7 years of relevant experience in security engineering, application security, cyber security delivery, technology risk or a related field.
• Practical experience applying security in at least one of: Salesforce, enterprise integrations, APIs, web applications, forms platforms or secure software delivery.
• Solid understanding of secure development practices, DevSecOps, code review, automated security testing, risk assessment and remediation.
• You can work independently within your specialism and escalate key design decisions and programme-level risks when needed.
• Clear communication skills, with the ability to work well with developers, architects, platform engineers, product owners and non-technical stakeholders.
• Experience producing high-quality technical documentation, assurance evidence, control guidance and reusable security patterns.
• Optional: experience with New Zealand Government programmes, NZISM, Protective Security Requirements, security certification and accreditation, or relevant security clearances would be beneficial.
• Optional: relevant certifications are desirable, such as Salesforce, MuleSoft, Adobe, OWASP, cloud, CISSP, CSSLP or equivalent security certifications.

Conditions

Management level: Manager.

Travel of up to 20%.

No visa sponsorship is available.

Benefits

• Discretionary bonus opportunities, generous referral bonuses, and retail discounts and deals.
• A $250 annual wellbeing allowance, life and income protection, an employee assistance program, a wellbeing app, and 15 days of paid sick leave.
• Group-rate health insurance, with eligibility applying.
• Flexible working and a supportive coaching culture.
• Two paid recognition days off each year during the annual summer shutdown, and the option to buy up to two extra weeks of annual leave.
• Paid parental leave for all parents with flexible options and financial planning support, inclusive networks, and paid volunteering leave.