Application Security Engineer

ASX: Powering Australia's financial markets Why join the ASX? When you join ASX, you’re joining a company with a strong purpose – to power a stronger economic future by enabling a fair and dynamic marketplace for all. In your new role, you’ll be part of a leading global securities exchange with a strong brand. We are known for being a trusted market operator and an exciting data hub. Want to know why we are a great place to work, click on the link to learn more. We are more than a securities exchange! The ASX team brings together talented people from a diverse range of disciplines. We run critical market infrastructure, with 1 in 3 people employed within technology. Yet we have a unique complexity of roles across a range of disciplines such as operations, program delivery, financial products, investor engagement, risk and compliance. We’re proud to foster a workplace where diversity is celebrated and inclusion is part of our everyday culture. Our employee-led networks champion LGBTIQ+ inclusion, promote gender equality, accessibility and wellbeing, inspire giving and volunteering, and celebrate cultural and religious events, creating a sense of belonging for all. As an AWEI Bronze employer and member of the Champions of Change Coalition for gender equality, we’re committed to a fair and inclusive workplace where everyone can thrive. Your Team: The role sits within Security Operations and Engineering, part of ASX Cyber Security. The team protects ASX’s technology environment by operating and engineering security capabilities across detection, response, vulnerability management and secure technology enablement. The role will work across multiple applications and delivery teams, tailoring AppSec uplift to each team’s maturity while maintaining delivery alignment and strengthening resilience across critical market infrastructure. Conduct targeted application security reviews and AI-assisted code analysis to identify exploitable vulnerabilities and structural weaknesses across priority applications. Prioritise, articulate and drive remediation of critical and high-severity code-level vulnerabilities in partnership with engineering teams. Support threat modelling, secure design reviews and application security assessments for priority applications and automation workflows. Adapt AppSec guidance to suit different engineering team maturity levels, balancing risk reduction, standardisation and delivery velocity. Provide practical secure coding guidance, remediation patterns and code-level recommendations to accelerate effective fixes. Raise, review or contribute to pull requests where appropriate to support timely remediation and knowledge transfer. Help define, refine and embed security checkpoints, guardrails and automation within the SDLC and CI/CD pipelines. Support optimisation of AppSec tooling, including SAST, DAST, SCA and related controls, so security testing is effective without unnecessarily impacting delivery velocity. Help establish or uplift Security Champion practices across delivery teams to sustain secure coding capability after the engagement. Produce handover documentation, reusable AppSec patterns and team enablement materials to support sustainable BAU ownership after the engagement. Your experience and qualifications Must have: Demonstrated experience in application security, secure software engineering or hands-on vulnerability remediation. Strong knowledge of secure coding practices, common application vulnerability classes and remediation approaches, including OWASP Top 10 risks and secure design principles. Experience reviewing application code and working with engineering teams to remediate vulnerabilities in modern development environments. Practical understanding of SDLC security controls, DevSecOps practices, CI/CD security integration and automated application security testing tools. Hands-on experience using AppSec tooling such as SAST, DAST, SCA, secret scanning, container or cloud security assessment tools. Experience working across multiple applications, platforms or delivery teams with varying levels of application security maturity. Ability to adapt approach based on risk, complexity and delivery context while maintaining strong stakeholder engagement. Ability to translate technical vulnerabilities into clear risk, priority and remediation guidance for delivery teams and stakeholders. Nice to have: Relevant security certification such as CSSLP, GWAPT, GWEB, OSWE, CISSP or equivalent practical experience. Experience in financial services, critical infrastructure or highly regulated technology environments. Exposure to AI-assisted security analysis, threat modelling or secure-by-design uplift programs. Experience with DevOps pipelines, Java or comparable enterprise development environments. Experience establishing Security Champion practices, mentoring developers or uplifting secure coding capability across teams. We make hiring decisions based on your skills, capabilities and experience, and how you’ll help us to live our values. We encourage you to apply even if you don’t meet all the criteria of this role. If you need any adjustments during the application or interview process to help you present your best self, please let us know at . At ASX Group, our diverse workforce is essential to build and maintain a fair and dynamic marketplace. We support flexible working and offer hybrid working options. Even if our roles are advertised as full-time, we encourage you to apply if you are interested in part-time or other flexible working arrangements. We will arrange for successful candidates to have background checks, including reference and police checks, completed as part of the on-boarding process. To be considered for this position, candidates must be legally authorised to work in Australia on a permanent basis without any restrictions.