Cybersecurity Engineer – JNCTN

As a Cybersecurity Engineer at JNCTN, you play a critical role in safeguarding our digital platforms, ensuring the security and privacy of customer credentials, and supporting compliance and resilience across our systems.

This is a hands-on, holistic security role. You won't just be writing policy; you will collaborate deeply with development, operations, and compliance teams to embed security into the DNA of our software and infrastructure. From hardening Azure pipelines to managing ISO 27001 compliance, you will touch every aspect of the security lifecycle.

Core Responsibilities

1. Product & Application Security (AppSec & DevSecOps)

• Secure by Design: Champion secure design and coding practices for JNCTN’s SaaS platforms.
• Pipeline Integration: Embed security controls into CI/CD pipelines (Azure DevOps, GitHub Actions) to automate testing and compliance.
• Vulnerability Management: Utilise SAST and DAST tools to identify, triage, and remediate vulnerabilities in web and mobile applications.
• Standards: Apply OWASP frameworks to mitigate threats specific to Verifiable Credentials and SaaS solutions.

2. Cloud Infrastructure & Identity (CloudSec & IAM)

• Azure Hardening: Continuously assess and harden our cloud infrastructure, utilising Azure Defender and native security tools.
• Identity Management: Manage the identity lifecycle for internal and external users, including SSO/MFA implementation, privileged access controls (PAM), and federation.
• Data Protection: Oversee encryption standards and Key Management Services to ensure absolute data confidentiality and integrity.

3. Governance, Risk & Compliance (GRC & Privacy)

• Regulatory Adherence: Maintain compliance with SOC2, ISO 27001, CCPA/US, and the Privacy Acts of NZ/AU.
• Risk Management: Conduct risk assessments, manage risk registers, and perform impact assessments for new features.
• Privacy Stewardship: Act as a key stakeholder in protecting user data, supporting responses to data subject requests and privacy inquiries.
• Vendor Security: Assess the security posture of third-party vendors, ensuring contractual SLAs meet JNCTN’s high security standards.

4. Security Operations (SecOps) & Incident Response

• Threat Hunting: Proactively monitor, detect, and triage alerts to identify potential threats before they escalate.
• Incident Response: Lead response activities including containment, forensic analysis, recovery, and post-incident reviews (tabletop exercises).
• Endpoint Security: Oversee the security posture of internal devices, ensuring our IT service provider maintains strict configuration and patch management standards.

What You Bring to the Team

Technical Skills

• Cloud Native: Deep expertise in Azure security ecosystems (Sentinel, Defender, Entra ID/Azure AD).
• DevSecOps: Proficiency in securing modern apps (React, API, .Net) and CI/CD pipelines (GitHub Actions).
• Tooling: Experience with SAST/DAST tools and vulnerability scanners.
• Frameworks: Strong grasp of OWASP, ISO 27001, and SOC2 controls.

Experience & Education

• Experience: 3–5+ years in a Cybersecurity Engineering, InfoSec, or related technical role.
• Track Record: Proven history in AppSec, Incident Response, or Cloud Security.
• Education: Bachelor’s degree in Computer Science/Cybersecurity or equivalent practical experience.
• Certifications: Relevant certifications (e.g., CISSP, CISM, AZ-500, CEH) are highly valued.

Soft Skills

• Communication: Ability to explain complex security risks to non-technical stakeholders.
• Problem-Solving: A "fixer" mindset—you don't just find problems; you help developers solve them.
• Autonomy: Highly independent and self-driven, capable of prioritising and managing tasks with minimal supervision.

A Day in the Life (BAU Tasks)

We believe in transparency. Here is what your routine might look like:

• Daily: Monitor Azure Defender alerts, manage quarantined items, triage urgent vulnerabilities, and sync with the dev team on secure design and code reviews.
• Weekly: Analyse security reports/trends, review and assign tickets in the tracking system, and ensure health checks on security sensors.
• Monthly: Conduct security posture reviews, update risk registers, and refine security policies based on new data.
• Quarterly: Perform user access reviews, plan infrastructure improvements, and assist with internal compliance audits.
• Yearly: Coordinate penetration testing, run disaster recovery drills, and support external ISO/SOC2 audits.