AppSec Engineer

Role Description

Seeking a development & cloud focused AppSec Engineer to join our expanding security team. The ideal candidate will have passion for AppSec, Cloud and AI. They will be a skilled communicator and relationship builder capable of promoting and building security practices across the organization and into our development processes.

What You’ll Own:

• Partner with different areas within Karbon - Ensure security is embedded from feature design and development to participating in design reviews and threat modelling.
• Balance Security and Delivery - Communicate security risks and issues to non-technical stakeholders, balancing delivery needs with security.
• Keep up to date on the latest technologies and approaches - Understand the importance of foundational security practices while being excited about new developments.
• Identify and assess security risks introduced by AI tools - Assist with reviewing the risks of AI tooling usage & integration and AI-generated code.
• Apply AI-assisted tooling to accelerate security work - Utilize AI across areas including triage, threat detection, code review, and documentation.
• Flexibility and confidence to work across multiple security domains - Gain exposure to various security domains in a fast-moving company.
• Work effectively as part of a team - Build relationships and trust across the organization to enhance Karbon’s security posture.
• Own your work - Take pride in your work and ensure customer data security.
• Bring your passion and personality - Contribute creativity, curiosity, and authenticity to strengthen the team.
• Help us measure improvement and steer our roadmap - Contribute to Security Metrics to track progress and feedback into our roadmap.

Qualifications

• 4+ years experience in a security or development role.
• Strong communication skills (spoken and written).
• Some of the following Languages/Frameworks: Microsoft .NET/C#, JavaScript (React and EmberJS frameworks), Python.
• At least one cloud platform: Azure, AWS, or GCP (predominantly Azure).
• Working knowledge of PowerShell or Bash and Python.
• Working knowledge of at least one AI development tool (e.g., Claude Code, GitHub Co-Pilot).
• Experience with Portswigger Burp or similar.
• Certifications such as Offsec OSCP & AWAE, GIAC, Burp Practitioner, PJPT, Microsoft/AWS development and cloud related are nice to have.
• Experience with securing AI applications, systems, and AI tooling would be highly regarded.

Requirements

• Collaborating with teams to review designs & implementations for security issues.
• Triaging issues and reports, assisting teams to remedy items and testing fixes.
• Working with external penetration test companies to validate and prioritize findings.
• Conducting risk and vulnerability assessments of web applications, APIs, and third-party suppliers.
• Configuring and tuning SAST, SCA, and DAST Tooling.
• Working with build/deployment pipelines to incorporate security tooling (GitHub Actions or Azure DevOps YAML based pipelines).
• Assisting with implementing security-focused alerting, detections, and automations.
• Conducting and facilitating organizational & developer-focused security training.
• Assisting with operational security items such as EDR alerts and MDM.
• Contributing to our security roadmap.

Benefits

• Gain global experience across Australia, New Zealand, UK, and Canada.
• Strong benefits package including flexible time off with an encouraged 4 weeks use per year.
• Company paid medical for you and eligible spouse/partner and dependents.
• Paid dental and vision for you and eligible spouse/partner and dependents.
• 401(k) with company matching.
• Flexible Spending Account.
• Up to 8 weeks paid parental leave.
• Work-from-home stipend.
• Collaborative, team-oriented culture that embraces diversity and invests in development.
• Be part of a fast-growing company that promotes high performers from within.