How to Hire a Senior Security Engineer in Australia

Oct 9

3 min read

Updated: Oct 15

Senior security engineers are hard to hire in Australia. Every company now holds customer data, runs in the cloud and faces regular attacks. The number of experienced security engineers has not kept up. This guide covers how to define the role, what to look for and how to find the right person.

Define the role first

Security engineer is a broad title. Two people with the same title can do very different work. Decide which area matters most to you:

Cloud security: securing AWS, Azure or Google Cloud setups, identity and access, and infrastructure as code.
Application security: secure code review, threat modelling and security testing in the development process.
Security operations: detection, monitoring and incident response.
Governance and compliance: frameworks such as ISO 27001, SOC 2, the Essential Eight and IRAP.

A first security hire at a scaleup often needs to cover several of these. A hire into an established security team usually goes deep in one.

Skills to look for

Hands-on engineering: they build and automate, not only write policy.
Strong cloud knowledge on the platform you use.
Scripting or coding in Python, Go or similar.
Experience with the security tools and logs in your environment.
Clear communication with engineers and executives.
Good judgment on risk: what to fix now and what to accept.

The best security engineers make it easy for developers to do the secure thing. Ask candidates how they got an engineering team to adopt a security change.

Where to find candidates

Most experienced security engineers are employed and get approached often. A job ad alone reaches few of them. Look in these places:

Banks, insurers and payments companies, which run large security teams.
Security consultancies and managed security providers.
Cloud and DevOps engineers who moved into security.
Government and defence, for people with clearance and strong process.
Software engineers who led security work inside product teams.

Tell candidates what they will own and how much support they will get. Security people want to know the company takes security seriously before they join.

How to run the interview

A technical discussion on a real scenario from your environment, such as a cloud misconfiguration or a suspicious login.
A threat modelling exercise on one of your systems.
A review of a past incident they handled: what happened, what they did and what changed after.
A meeting with an engineering lead, to test how they work with developers.

Check whether the role needs a security clearance before you start. Clearance rules limit your candidate pool, so decide early.

Keep the process fast

Strong security engineers often have several offers. Move from first interview to offer within three or four weeks. Give feedback quickly after each stage.

Related guides

Not sure which kind of security role you need? Read red, blue and purple teams: security roles explained.

Hiring for AI as well? Read our guides on ML engineers and forward deployed engineers.

How Staff Hunter helps

Staff Hunter recruits security engineers and cloud security specialists for startups, scaleups and established businesses in Australia. We find people through direct headhunting. See our cyber security recruitment page, or book a 30-minute call to talk through your role.

Book a 30-minute call