Careers
Ship to systems people use on day one.
Work across the systems we run in production: 1,797 deploys and releases shipped since 1 Jan 2026.
The work
What working here looks like.
Production from day one
You ship to systems people use today, and you stay accountable for them after they ship.
Builders beside testers
The security practice reviews what engineering builds, and engineering fixes what testing finds.
Clear findings
Decisions and findings go to clients in plain English, so clear writing is part of the job.
Our own products
Some briefs start inside the firm. We run software ventures of our own, and the engineers who build them sit on the same bench as the client work.
Open roles
Roles open now.
- Apply
Engineering
Senior Software Engineer
Own systems end to end, from architecture to release, across Aurii, the platforms we run and Jetstone as it is built.
What you will do and what you need
What you will do
- Design, build and operate production systems, and stay accountable for them after they ship.
- Work across several production codebases and stacks.
- Set the engineering bar on the work you touch: architecture, code review, and the way findings become fixes.
- Threat-model and harden what you build alongside the security practice, and re-test once fixes land.
What you need
- Deep experience designing, shipping and operating production software.
- Strong cloud engineering, ideally on Azure.
- The habit of treating security as part of the design.
- Plain, direct communication. Your decisions and findings go to clients as you set them down.
- The right to work in Australia.
- Apply
Engineering
Software Engineer
Build and fix systems in production. You will ship features that reach users, with senior engineers reviewing and shipping beside you.
What you will do and what you need
What you will do
- Ship features across web applications, APIs and infrastructure that run in production today.
- Contribute across the codebases we run, including Aurii, and to Jetstone as it is built for its 2027 launch.
- Fix what testing finds, then re-test to confirm the fix landed.
- Write code that stands up to review by the security practice.
What you need
- Solid engineering fundamentals and experience with a modern web stack.
- Working knowledge of cloud infrastructure.
- An interest in security and the discipline to build with it in mind.
- Clear communication on the page.
- The right to work in Australia.
- Apply
Security
Cyber Security Consultant
Assessment, hardening and advisory work for clients. You will run offensive testing, write findings a client can act on, and re-test once the fix lands.
What you will do and what you need
What you will do
- Run penetration tests and security assessments against the OWASP and ASD playbooks.
- Assess and harden cloud environments, including Azure and Entra ID.
- Take clients through compliance readiness against the Essential Eight, SMB1001 and ISO 27001.
- Write findings with reproduction steps and a recommended fix for each one.
- Re-test remediation and contribute to standing advisory engagements, including vCISO work.
What you need
- Hands-on penetration testing or security assessment experience.
- Working knowledge of the frameworks clients are asked for: the Essential Eight, SMB1001, ISO 27001, and the Privacy Act.
- Enough engineering background to read code and talk credibly to the people who wrote it.
- Reporting discipline. Findings are manually verified and reproducible before they are reported.
- The right to work in Australia.
- Apply
Security
Penetration Tester
Test web applications, APIs, cloud tenants and networks for clients, prove each finding and write it up to be fixed.
What you will do and what you need
What you will do
- Scope and run penetration tests against the OWASP and ASD playbooks, from recon to report.
- Verify every finding by hand and record the reproduction steps as you go.
- Write reports a client can act on, with a recommended fix for each finding.
- Re-test remediation and sign off the fix, or send it back with what is still open.
What you need
- Hands-on penetration testing experience against production systems, with reports you wrote yourself.
- Working fluency with Burp Suite, a scripting language and the cloud consoles clients run.
- Enough engineering background to read code and talk credibly to the people who wrote it.
- An OSCP, OSWE, CREST CRT or equivalent, or the work to show for one.
- The right to work in Australia.
- Apply
Engineering
Platform Engineer
Run the hosting, pipelines and monitoring behind what we build and defend, and keep releases boring.
What you will do and what you need
What you will do
- Operate Azure and container hosting, networking, backups and secrets for production systems.
- Build and maintain CI/CD pipelines, release gates and the checks that stop a bad build shipping.
- Run the monitoring and alerting that pages an engineer when something real is wrong.
- Harden the estate to the Essential Eight and ISO 27001 controls, and show the evidence on request.
What you need
- Solid experience running production infrastructure on Azure or a comparable cloud.
- Infrastructure as code, Linux, containers and the networking to connect them properly.
- The instinct to automate the second time, and to write down what you did the first time.
- An interest in security and the discipline to build with it in mind.
- The right to work in Australia.
- Apply
Compliance
Compliance Consultant
Take clients to SMB1001, Essential Eight, ISO 27001 and Privacy Act readiness, with evidence read from the systems themselves.
What you will do and what you need
What you will do
- Run gap assessments and readiness programmes against SMB1001, the Essential Eight, ISO 27001 and the Privacy Act.
- Read each control back from the tenant, device or system that enforces it and record the evidence.
- Write policies, registers and plans the client will use, in plain English.
- Prepare clients for audits and certification reviews, and sit beside them through the questions.
What you need
- Experience taking organisations through SMB1001, the Essential Eight, ISO 27001 or SOC 2.
- Working knowledge of Microsoft 365 and Entra ID, since that is where most controls are read.
- The habit of checking a control is on before writing that it is.
- Clear, plain writing. Your documents go to clients and auditors as you set them down.
- The right to work in Australia.
- Apply
Security
Incident Responder
Contain and investigate breaches for clients, write the record regulators read, and tune detection for the next one.
What you will do and what you need
What you will do
- Take the first call on the incident line, triage, and lead containment in cloud and on-premises estates.
- Investigate with endpoint, identity and log evidence, and keep a timeline that stands up later.
- Write the incident record, the notification assessment and the remediation plan.
- Turn each incident into detection rules and playbooks for our monitoring and for Jetstone.
What you need
- Hands-on incident response or SOC experience with real intrusions, not only exercises.
- Fluency with Microsoft Defender, Entra ID sign-in and audit logs, and a SIEM query language.
- The calm to run a bridge call at two in the morning, and the care to write it up by nine.
- Working knowledge of the Notifiable Data Breaches scheme and what an insurer asks after an incident.
- The right to work in Australia.
Head office
Level 35, Riparian Plaza.
71 Eagle Street, Brisbane QLD 4000
Contact usPhotograph of the Eagle Street entrance: Kgbo, Wikimedia Commons, CC BY-SA 4.0, cropped.
Want to do this work?
Send a short note on what you have built or tested, and which role you are applying for.