Enterprise Digital

We are building an expert team to deliver best in class solutions for our customers. Our mission is to “Create delightful experiences that help our customers achieve better health”.

Want to meet the team and learn more about working with our digital and technology teams? Follow this link to learn more: https://digitalcareers.medibank.com.au

We are seeking a Senior DevSecOps Engineer to design, build and operate our Product Security Engineering capability. You’ll lead technical implementation of cloud and application security services across the SDLC, including secure CI/CD, SAST, SCA, IaC scanning, container & secret scanning, SaaS posture management and infrastructure-as-code security. This is a hands‑on engineering role responsible for delivering squad requirements, strengthening Medibank’s security posture and automating detection and response.

Key responsibilities:

• Design, implement and operate secure CI/CD pipelines with security gates, pipeline-as-code templates and developer feedback loops.
• Deploy and manage SAST, SCA, IaC scanners, container scanning and secret detection across platforms and languages.
• Build security-as-code frameworks, reusable security libraries and policy-as-code for guardrails.
• Aggregate and manage vulnerability findings; establish remediation workflows and validate fixes.
• Integrate security tooling into developer workflows (IDEs, PRs, pipelines) and optimise for low false positives and developer experience.
• Implement runtime/container security and enforce image/base image standards.
• Produce SBOMs, enforce dependency policies and automate dependency remediation.
• Collaborate with product teams, Security Platform Services, Automation Engineering, Security Ops and Security Architecture to embed DevSecOps practices.
• Create metrics, dashboards and automation to demonstrate coverage, trends and remediation velocity.

What we’re looking for:

• 7+ years in security engineering/DevSecOps or related role with strong hands-on delivery.
• Expert programming/scripting (Python, Go, Java) and experience with backend and scripting workflows.
• Deep knowledge of SDLC, agile practices, microservices, containerisation and API development.
• Practical experience with CI/CD platforms (Jenkins, GitHub Actions, Azure DevOps, AWS DevOps).
• IaC experience (Terraform, CloudFormation); implement IaC security scanning (Checkov, Terrascan, etc.).
• Hands-on with SAST, SCA (Snyk/Dependabot), secret scanning (GitGuardian/GitHub), container scanning and vulnerability management.
• Strong AWS cloud security experience and familiarity with CSPM/CWPP/CASB concepts.
• Excellent stakeholder collaboration and ability to embed security into developer workflows.

Strongly desirable:

• Experience building developer platforms/self‑service capabilities.
• Offensive security/penetration testing background, bug bounty or vulnerability disclosure experience.
• Contributions to open source, public speaking/writing on DevSecOps topics.
• Familiarity with chaos engineering, ML/AI security considerations.