# Staff Security Engineer **Company:** [Articore Group](http://jobs.workable.com/companies/qHpxJpoN62YHb3uDzQmMaN.md) **Location:** Melbourne, Australia **Workplace:** hybrid **Employment type:** Full-time **Department:** Engineering [Apply for this job](http://jobs.workable.com/view/1d263c9a-1025-4caa-9090-24f91b478494) ## Description Articore runs Redbubble, TeePublic, Dashery, and Frankly Wearing - some of the largest creator marketplaces in the world, with Redbubble's catalog alone exceeding 40 billion SKUs. The Infrastructure team stewards the foundational platform supporting our global marketplaces, driving system reliability, scalability, and performance. By delivering core infrastructure services, Infrastructure as Code (IaC) expertise, and sophisticated tooling, the team enables engineers to deploy code securely and efficiently across our hybrid architectures – predominantly built on AWS ECS and EKS (Kubernetes). As Staff Security Engineer, you'll be the security driver within DEAP: the person accountable for making risk visible, turning gaps into actionable work, and ensuring our core security practices are implemented and sustained across every property. This is a senior individual contributor role. You'll deliver through a combination of deep hands-on work and influence — establishing standards, running key processes, coaching engineers, and partnering with Infrastructure and DevOps to get changes shipped — rather than through line management. The remit will evolve as our security strategy solidifies. We're looking for someone who wants to help shape that strategy, not just execute a fixed checklist. **Core Responsibilities** Application & Platform Security - Maintain a current inventory of applications, services, and data flows across Redbubble, TeePublic, FranklyWearing, and Dashery. - Run and tune security assurance across the delivery lifecycle - SAST, DAST, dependency/SCA, container and infrastructure scanning - integrated into CI/CD, not ad hoc. - Triage findings from automated tooling and external penetration testing (e.g. Cobalt) against defined remediation SLAs (e.g. critical ≤ 7 days, high ≤ 30) and track them to closure. - Build security champions in delivery teams so security scales beyond one person. Compliance, PCI & Control Operations - Drive PCI DSS activities within DEAP's scope: CDE scope definition, SAQ/ROC completion, quarterly ASV scans, segmentation evidence, and audit liaison. - Run the audit calendar so evidence is collected continuously, not assembled under pressure. - Maintain a working risk register - owners, due dates, treatment decisions, review cadence — and report risk and compliance status to leadership in business terms. - Partner with legal and privacy on GDPR/CCPA-adjacent technical controls: retention, deletion, and access. - Support access governance: joiner/mover/leaver process, quarterly recertification of production and admin access, and least-privilege IAM. Security Incident Response - Own and improve the security incident process end to end: severity definitions, escalation paths, comms templates, and response coordination. - Act as incident commander for security-led and security-relevant incidents. - Ensure post-incident reviews are blameless, specific, and tracked to completion. - Partner with Infrastructure and DevOps on handoffs between security response and production reliability response. Bot, Log & Signal Stewardship - Own bot management proactively: monitor bot load and cost impact (e.g. Cloudflare) and tune mitigation with relevant teams and vendors ahead of overages, not after them. - Improve logging hygiene and drive toward zero-error logs — errors triaged and reduced over time, not tolerated as background noise. Vendor & Tooling Security Stewardship - Evaluate new technical vendors for security and operational risk - data access, SOC reports, DPAs - before purchase, not after onboarding. - Contribute engineering judgment to renewal and rationalisation decisions alongside IT, finance, and procurement, identifying ways to get more value from existing spend. Security Roadmap & Prioritisation - Own a prioritised backlog of security improvements across DEAP and carry it into engineering and product planning so the work gets funded and shipped through the normal delivery cycle. ## Requirements - Senior-level experience in security engineering, DevSecOps, security operations, or platform security for a production SaaS or marketplace platform. - Hands-on experience running or tuning SAST/DAST/SCA, container, and infrastructure scanning integrated into CI/CD, plus triaging penetration test findings against SLAs. - Experience running security incident response as incident commander, including blameless postmortems with tracked follow-through. - Working knowledge of PCI DSS (or an equivalent control regime) and practical audit and evidence requirements — risk registers, access recertification, and reporting risk to leadership in plain business language. - Comfort operating in a cloud-native environment, ideally AWS. - A track record of driving outcomes as a senior IC through influence rather than formal authority — proposing action, building buy-in, and coaching engineers who don't report to you. - Vendor security review and IT financial stewardship experience — SOC reports, DPAs, FinOps, renewal and contract management. - Experience with bot management and traffic mitigation at scale (e.g. Cloudflare). - Experience using AI tooling in your day-to-day workflow, and curiosity about applying it more deeply **Key attributes of success** - Track record of driving outcomes as a senior IC through influence rather than formal authority — proposing action, building buy-in, and coaching engineers without being their manager - Comfortable with a remit that evolves as the security strategy solidifies — helping shape strategy, not just executing a fixed checklist - Demonstrated effectiveness operating in a global company, with the communication, discipline, and async judgment required to keep work moving across time zones - Able to translate technical complexity for non-technical stakeholders and align decision-makers around clear outcomes, including timelines, scope, and risks - Comfortable balancing system health against delivery pressure, and prioritising your own time across parallel, often-ambiguous efforts - Inclusive collaborator who engages stakeholders across disciplines, backgrounds, and seniority — and leads teams confidently through change ## Benefits Work Environment: - Hybrid work model, with one-two days on-site presence required. - Collaboration across time zones to support global teams. What We Offer - High Trust Culture: Thrive in an environment built on mutual respect where your voice matters. - Flexible Work Arrangements: The opportunity to balance your work and personal life with flexible schedules. - Global Opportunities: Be part of a global organisation that offers diverse and enriching experiences. - Monthly Wellness Allowance: Take care of yourself with a monthly wellness allowance to spend on your health and well-being. - Exclusive Vouchers and Discounts: Benefit from deals and discounts on our online marketplaces.