Senior Cybersecurity Engineer
Philippines (remote) · Full-time · Reports to the Head of Technology
About Voltex
Voltex Electrical is an electrical wholesale distributor that serves electricians across Australia and New Zealand. We sell direct to the trade, and our customers order from us every week. The business is growing fast, and technology is central to how we get there.
The Role
You will be part of a high-performance team who operate in a fast paced environment, this is a hands-on engineering role. Security testing of websites, web applications, APIs, and mobile apps is a core responsibility alongside our identity, endpoint, cloud, and network security. You find weaknesses, rank them by business risk, and fix them or work with the teams that own the systems to verify the fix.
You sit outside the infrastructure team to provide independent security challenge. Your job in year one: make the business measurably safer and give the Head of Technology an evidence-based view on priorities, residual risk, and where specialist support or additional capacity is needed.
What you will do
- Manually test public-facing and internal web applications and APIs, including authenticated journeys, authentication, sessions, object and role authorization, tenant boundaries, and business-logic abuse. Use scanners to support, not replace, manual investigation.
- Assess mobile apps on the platforms we use, including local storage and logging, authentication and sessions, network trust, platform interactions, and their backend APIs. Identify where deeper specialist testing is needed.
- Review relevant source code, configuration, and designs with developers. Build practical threat modelling, security checks, and regression tests into the development lifecycle, including code, dependency, and secrets scanning in CI/CD.
- Document reproducible findings and business impact, agree remediation owners and dates, help developers fix root causes, and independently retest their fixes. Track coverage, overdue risks, and time-bound risk exceptions with the Head of Technology.
- Agree written scope and authorisation before testing, including environments, test accounts and data, production safeguards, and stop conditions. Protect customer information and avoid disruption.
- Own security posture in Microsoft Entra ID and Microsoft Defender: Conditional Access, multi-factor authentication coverage, privileged access, and alert routing.
- Run incident response for security events, from detection through to the post-incident review.
- Review security-relevant application, access, network, and infrastructure changes before release, and act as the named security approver for high-risk changes. Arrange separate review of your own high-risk changes and escalate unresolved release risks to the Head of Technology.
- Enforce secrets and identity hygiene for people, workloads, and AI agents: Azure Key Vault, managed identities, no embedded credentials, least privilege for every integration.
- Investigate account takeover and fraud signals with our QA and Customer Service teams, and close the gaps they expose.
- Run security awareness and phishing resistance for Voltex staff.
How to Apply
Send your CV and a short, sanitised example of a web, API, or mobile vulnerability you personally investigated. Explain what you tested, the business impact, your role in remediation, and how the fix was retested. Do not include client data or confidential code. Be ready to walk through your evidence and an authorised practical scenario at interview. Alternatively applying through Linkedin is fine as well
Requirements
What you bring
We value proven, hands-on ability more than any one certification. Application testing and the ability to drive fixes through retest are essential. You should be able to show:
- Web and API security — personally investigating and validating weaknesses in authenticated websites, web apps, and APIs, including authorisation and business logic, using an intercepting proxy such as Burp Suite or an equivalent tool.
- Mobile application security — hands-on assessment of mobile-client security and backend APIs on relevant platforms, with a clear understanding of your testing limits.
- Code review and remediation — reading source and configuration, explaining root causes, working with developers on fixes, and verifying retests and regression coverage. Our web stack includes .NET/IIS; strong transferable experience is welcome.
- Cloud and on-premises security — securing Microsoft Azure workloads and hybrid estates — cloud resources alongside on-premises servers and Active Directory.
- Identity — Entra ID administration, Conditional Access design, MFA rollout, and privileged access management.
- Endpoints — Microsoft Defender and EDR platforms (we run CrowdStrike), plus device management with Intune.
- Network security — firewalls, segmentation, and SASE/SD-WAN environments (we run Cato).
- Incident response — detection, containment, and clear post-incident write-ups.
- Frameworks — using OWASP guidance to structure application testing and the ASD Essential Eight or a comparable framework to turn broader security controls into practical work.
You communicate risk in plain business terms, work well remotely across AU/NZ time zones, and can operate independently as the sole security specialist. We expect sound judgement across the wider estate, not expert-level experience with every named product.
Nice to have
- Security certifications such as AZ-500, SC-200, or equivalent experience.
- Experience securing data platforms (we run Databricks) or governing AI tool and agent access.
- Experience running phishing simulation and security awareness programmes.
- Deeper native mobile testing, reverse engineering, or experience commissioning and validating specialist penetration tests.
Benefits
- Fully WFH with flexible working hours
- Paid Parental Leave
- Annual and sick Leave - 20 Service Inventive Leave (SIL) days per year
- Healthcare - HMO Coverage for up to four (4) dependants
- Monthly food allowance
Skills Required
- Hands-on web and API security testing, including authenticated applications, authorization, and business logic, using Burp Suite or an equivalent intercepting proxy.
- Hands-on mobile application security assessment and backend API testing.
- Ability to review source code and configuration, explain root causes, collaborate on remediation, and verify fixes through retesting and regression coverage.
- Experience securing Microsoft Azure workloads and hybrid environments, including on-premises servers and Active Directory.
- Experience administering Microsoft Entra ID, designing Conditional Access, rolling out MFA, and managing privileged access.
- Experience with Microsoft Defender, EDR platforms such as CrowdStrike, and device management with Intune.
- Experience with network security, including firewalls, segmentation, and SASE or SD-WAN environments.
- Incident response experience covering detection, containment, and post-incident reporting.
- Experience using OWASP guidance and ASD Essential Eight or a comparable security framework.
- Security certification such as AZ-500, SC-200, or equivalent experience.
- Experience securing data platforms such as Databricks or governing AI tool and agent access.
- Experience running phishing simulations and security awareness programs.
- Deeper native mobile testing, reverse engineering, or commissioning and validating specialist penetration tests.
What We Do
Voltex Electrical Accessories are a direct supplier to licenced electrical contractors. Being the manufacturer we're responsible for the design, build, certification, warranty, and distribution of all Voltex products, and we partner with leading global players in production of switch-gear and circuit control products. The business model involves controlling everything, right through to using only direct distribution from Voltex's own warehouses to account-holders, who enjoy the support of policies like a 25 year warranty, and '365 day no-questions-asked' goods return. Direct distribution helps us save every cost we can, so we can pour more money into quality, production and service, then pass the rest of the savings on to our electrical contractor friends. Established in February 2001, Voltex continues to achieve rapid, consistent growth by focusing on compliance, high performance and reliability, with an unflinching commitment to looking after electrical contractors, the guys that do the work. This gives Contractors a good recipe for business success and a competitive edge. Forward ordering and buying online has meant a new way for the trade, and it's been a fun ride helping electricians make the move! We're barracking for our contractors! The 'No questions Asked' returns policy is to make it easy for contractors to order things quickly without the risk of getting stuck with it!. We've got every respect for your competency in ordering, and any time down the track you need to reverse the deal, it’s OK. Whether you over-ordered, changed your mind, or simply lost that job, return freight is free and we raise a credit. Just let us know it needs to come back, and we'll arrange pickup. We welcome personal customer interactions, and would love to hear from you on 1300 722 275, Facebook, email or LinkedIn. If you're in the area, please feel free to visit us. You're very welcome. Shop online today at www.voltexelectrical.com.au.
