Senior Product Security Engineer T500-20534

About REA Group:

In 1995, in a garage in Melbourne, Australia, REA Group was born from a simple question: "Can we change the way the world experiences property?"

Could we? Yes. Are we done? Never.

Fast forward 30 years, REA Group is a market leader in online real estate in three continents and continuing to grow rapidly across the globe. The secret to our growth is staying true to that 'day one' mindset; the hunger to innovate, the ambition to change the world, and the curiosity to reimagine the future.

Our new Tech Center in Cyber City is dedicated to accelerating REA Group's global technology delivery through relentless innovation. We're looking for the best technologists, inventors and leaders in India to join us on this exciting new journey.

If you're excited by the prospect of creating something magical from scratch, then read on.

Lead Product Security Engineer

What the role is all about:

The Product Security team works alongside our Security Operations and Security Advisory teams to form the Group Security Tribe. Group Security works together to embed security throughout REA, empowering staff to make good risk decisions and equipping them with the tools to do so – a cyber health service, not a police force.

With us, you'll have an impact. If you're looking for a security-by-the-numbers role, this isn't the job for you. If you are looking to work alongside some of the brightest and best in the industry – read on

As a Senior Product Security Engineer, you will collaborate with delivery teams in the implementation of solutions using a variety of programming languages and cloud technologies to target improvements to existing software applications and systems, build capability and further the culture of software custodianship at REA, influencing and educating across the business.

You will also work on implementing and maintaining security tooling in cloud deployments, CI/CD pipelines, networking and monitoring, to support business objectives. You will use your experience in software development security practices and collaboration skills to adapt and build a plan as necessary to meet security objectives.

While no two days are likely to be the same, your typical responsibilities will include:

• Support and consult with product and development teams for application security, including threat modelling and code reviews.
• Designing, building, testing and deploying changes to software to remediate security issues and integrate security tools, using a variety of technologies and platforms.
• Assist teams in reproducing, triaging, and addressing application security vulnerabilities.
• Assist in development of security processes and automated tooling that prevent classes of security issues
• Work directly with product delivery teams to embed security practices into their ways of working
• Implementing, operating, and supporting security tooling, services, platforms and patterns to support IT delivery teams.
• Advocate for security practices within the developer and other stakeholder communities.

Who we're looking for:

Demonstrated competency of:

• Technology & software engineering principles and best practices.
• Experience with Application security frameworks such OWASP Top 10, ASVS, NIST
• Web technologies, common web frameworks, their vulnerabilities and mitigations.
• Security thinking within the DevSecOps software development lifecycle.
• Experience implementing common application security tooling for CI/CD integrations (such as SAST/DAST etc.) in build pipelines
• Experience with DDoS, WAF or anti-bot protection technologies
• Making trade-offs between risk, reward and prioritising improvements
• Demonstrated growth mindset, work productively in a fast paced & agile environment.

Experience:

• At least 8+ years of experience working in application security and software development.
• Navigating complex organisational change challenges using systems and product thinking.
• Skills in two or more of our programming languages – such as Java, Python, TypeScript, Kotlin and/or JavaScript.
• Familiarity with infrastructure as code and build tools like Terraform and Buildkite.
• Skills in modern software development techniques such as object orientation, test driven development, micro-services, pair programming and continuous delivery.

Other Skills:

• Excellent communication and interpersonal skills.
• Understanding of cloud infrastructure and technologies.
• Tertiary qualification in Computer Science or similar highly desirable.
• Able to communicate and collaborate effectively with business stakeholders.

What we offer:

• A hybrid and flexible approach to working.
• Transport options to help you get to and from work, including home pick-up and drop-off.
• Meals provided on site in our office.
• Flexible leave options including parental leave, family care leave and celebration leave.
• Insurances for you and your immediate family members.
• Programs to support mental, emotional, financial and physical health & wellbeing.
• Continuous learning and development opportunities to further your technical expertise.

The values we live by:

Our values are at the core of how we operate, treat each other, and make decisions. We believe that how we work is equally important as what we do to achieve our goals. This commitment is at the heart of everything we do, from the way we interact with colleagues to the way we serve our customers and communities.

Our commitment to Diversity, Equity, and Inclusion:

We are committed to providing a working environment that embraces and values diversity, equity and inclusion. We believe teams with diverse ideas and experiences are more creative, more effective and fuel disruptive thinking - be it cultural and ethnic backgrounds, gender identity, disability, age, sexual orientation, or any other identity or lived experience. We know diverse teams are critical to maintaining our success and driving new business opportunities. If you've got the skills, dedication and enthusiasm to learn but don't necessarily meet every single point on the job description, please still get in touch.

REA Group in India:

You might already recognise our logo. The REA brand does have an existing presence in India. In fact, we set up our new tech hub in Gurugram to be their neighbours

REA Group holds a controlling interest in REA India Pte. Ltd., operator of established brands , and , three of the country's leading digital property marketplaces.

Through our close connection to REA India, we've seen first-hand the incredible talent the country has to offer, and the huge opportunity to expand our global workforce. Our Cyber City Tech Center is an extension of REA Group; a satellite office working directly with our Australia HQ on local projects and tech delivery.

All our brands, across the globe, connect regularly, learn from each other and collaborate on shared value initiatives.