Application Security Engineer

About Us

hummgroup is a diversified financial services company that provides instalment plans which enable businesses and consumers to make large purchases. hummgroup operates in Australia, New Zealand, Ireland, Canada and the United Kingdom. Its principal activities include Commercial Lending in Australia and New Zealand; Point of Sale Payment Plans; Australia Cards (humm®90, Lombard and Once); and New Zealand Cards (including Farmers Finance Card, Farmers Mastercard®, Q Card, Q Mastercard® and Flight Centre Mastercard®).

About the Team

The Security Team sits within Digital & Transformation at hummgroup and is responsible for protecting enterprise systems, data, customers and colleagues through effective security controls, risk management and operational discipline.

The team partners closely with architecture, engineering, infrastructure, service management, and business teams to strengthen security posture, support regulatory obligations and enable safe, reliable technology outcomes.

Flexibility, accountability and collaboration are key, with team members encouraged to take ownership of security controls and contribute to continuous improvement across the technology environment.

What Your Responsibilities Look Like…

You will embed application security across the delivery lifecycle by:

• Secure design and threat modelling: Leading secure design reviews and threat modelling for new products, platforms, APIs and third-party integrations, and providing clear, risk-based recommendations.

• Secure code review: Performing manual and tool-assisted code reviews for high-risk changes, including payment, authentication and customer data flows.

• Security testing in CI/CD: Owning and tuning application security tooling (SAST, DAST, SCA/dependency, secrets, container and infrastructure-as-code scanning) and integrating it into CI/CD pipelines with agreed quality gates.

• Vulnerability / Exposure management: Triaging, risk-rating and tracking application vulnerabilities, and working with engineering teams to fix them within agreed SLAs.

• Standards and guardrails: Developing and maintaining application security standards, secure coding guidelines, reusable patterns and guardrails, including for APIs, authentication and secrets management.

• Penetration testing: Scoping, coordinating and managing penetration testing and red team engagements with external vendors and project teams, and ensuring findings are validated and closed.

• Responsible disclosure: Managing the responsible disclosure program, including intake, triage, researcher communication and remediation tracking.

• AI security: Supporting security reviews and testing of AI use cases and AI-enabled applications, including risks such as prompt injection, data leakage and insecure integrations.

• Software supply chain: Maintaining visibility of application components and third-party libraries (e.g. a software bill of materials) to support vulnerability and patch management.

• Developer enablement: Building secure coding capability through training, practical guidance and a network of security champions within engineering teams.

• Reporting: Tracking and reporting application security metrics and risk posture to security leadership and relevant governance forums.

• Audit and compliance: Supporting audit, PCI DSS, ISO 27001 and other regulatory obligations related to application security, including evidence for secure development and testing controls.

About you…

Skills

• Proven hands-on experience in application security and secure SDLC / DevSecOps practices.

• Solid understanding of web, API, mobile and cloud application security risks, including the OWASP Top 10 and OWASP API Security Top 10.

• Experience running and tuning SAST, DAST, SCA and secrets scanning tools, and integrating them into CI/CD pipelines (e.g. GitHub, Azure DevOps).

• Ability to read and review code in at least one common language (e.g. Java, C#/.NET, JavaScript/TypeScript or Python).

• Ability to perform threat modelling, secure design reviews and application security assessments, and to validate penetration test findings.

• Working knowledge of authentication and authorisation standards (OAuth 2.0, OpenID Connect, SAML) and secure secrets management.

• Experience with cloud platforms, ideally AWS and/or Azure, including container and infrastructure-as-code security.

• Ability to explain risk clearly and work constructively with engineering teams to improve security without unnecessarily slowing delivery.

• Strong stakeholder engagement skills across security, architecture, engineering, delivery and risk teams.

Desirable:

• Experience in financial services, payments, fintech or other regulated environments.

• Knowledge of PCI DSS v4.0.1, ISO 27001 or similar frameworks.

• Experience managing penetration testing vendors, bug bounty or responsible disclosure programs.

• Experience securing AI / LLM-enabled applications, including familiarity with the OWASP Top 10 for LLM Applications.

• Experience developing secure coding standards, reusable security patterns or application security guardrails.