About Us hummgroup is a diversified financial services company that provides instalment plans which enable businesses and consumers to make large purchases. hummgroup operates in Australia, New Zealand, Ireland, Canada and the United Kingdom. Its principal activities include Commercial Lending in Australia and New Zealand; Point of Sale Payment Plans; Australia Cards (humm®90, Lombard and Once); and New Zealand Cards (including Farmers Finance Card, Farmers Mastercard®, Q Card, Q Mastercard® and Flight Centre Mastercard®). About the Team The Security Team sits within Digital & Transformation at hummgroup and is responsible for protecting enterprise systems, data, customers and colleagues through effective security controls, risk management and operational discipline. The team partners closely with architecture, engineering, infrastructure, service management, and business teams to strengthen security posture, support regulatory obligations and enable safe, reliable technology outcomes. Flexibility, accountability and collaboration are key, with team members encouraged to take ownership of security controls and contribute to continuous improvement across the technology environment. What Your Responsibilities Look Like… You will embed application security across the delivery lifecycle by: Secure design and threat modelling: Leading secure design reviews and threat modelling for new products, platforms, APIs and third-party integrations, and providing clear, risk-based recommendations. Secure code review: Performing manual and tool-assisted code reviews for high-risk changes, including payment, authentication and customer data flows. Security testing in CI/CD: Owning and tuning application security tooling (SAST, DAST, SCA/dependency, secrets, container and infrastructure-as-code scanning) and integrating it into CI/CD pipelines with agreed quality gates. Vulnerability / Exposure management: Triaging, risk-rating and tracking application vulnerabilities, and working with engineering teams to fix them within agreed SLAs. Standards and guardrails: Developing and maintaining application security standards, secure coding guidelines, reusable patterns and guardrails, including for APIs, authentication and secrets management. Penetration testing: Scoping, coordinating and managing penetration testing and red team engagements with external vendors and project teams, and ensuring findings are validated and closed. Responsible disclosure: Managing the responsible disclosure program, including intake, triage, researcher communication and remediation tracking. AI security: Supporting security reviews and testing of AI use cases and AI-enabled applications, including risks such as prompt injection, data leakage and insecure integrations. Software supply chain: Maintaining visibility of application components and third-party libraries (e.g. a software bill of materials) to support vulnerability and patch management. Developer enablement: Building secure coding capability through training, practical guidance and a network of security champions within engineering teams. Reporting: Tracking and reporting application security metrics and risk posture to security leadership and relevant governance forums. Audit and compliance: Supporting audit, PCI DSS, ISO 27001 and other regulatory obligations related to application security, including evidence for secure development and testing controls. About you… Skills Proven hands-on experience in application security and secure SDLC / DevSecOps practices. Solid understanding of web, API, mobile and cloud application security risks, including the OWASP Top 10 and OWASP API Security Top 10. Experience running and tuning SAST, DAST, SCA and secrets scanning tools, and integrating them into CI/CD pipelines (e.g. GitHub, Azure DevOps). Ability to read and review code in at least one common language (e.g. Java, C#/.NET, JavaScript/TypeScript or Python). Ability to perform threat modelling, secure design reviews and application security assessments, and to validate penetration test findings. Working knowledge of authentication and authorisation standards (OAuth 2.0, OpenID Connect, SAML) and secure secrets management. Experience with cloud platforms, ideally AWS and/or Azure, including container and infrastructure-as-code security. Ability to explain risk clearly and work constructively with engineering teams to improve security without unnecessarily slowing delivery. Strong stakeholder engagement skills across security, architecture, engineering, delivery and risk teams. Desirable: Experience in financial services, payments, fintech or other regulated environments. Knowledge of PCI DSS v4.0.1, ISO 27001 or similar frameworks. Experience managing penetration testing vendors, bug bounty or responsible disclosure programs. Experience securing AI / LLM-enabled applications, including familiarity with the OWASP Top 10 for LLM Applications. Experience developing secure coding standards, reusable security patterns or application security guardrails. hummgroup is a diversified non-bank financial services institution offering business financing products, credit cards, and point-of-sale finance plans designed around the core needs of today’s shoppers, retailers, and small to medium enterprises. Our experience as a leader in financing larger purchases – whether through working with our retail partners or making our offers direct to customers – provides the platform, stability, strength and the acumen to support us in our continuing innovation journey in the face of tech and service evolution. We have built a strong global team of high performing people who are focused on delivering the best customer experience and innovative products. Introduce Yourself! We're always on the lookout for talent. If you are thinking about a future with us, click Get Started below to stay connected with us and be informed of any new opportunities that meet your interest!

Application Security Engineer.

more at Flexigroup.

Commercial Collections Officer

Financial Accountant

Casual Finance Student Role - Commercial Support Officer

similar roles.

Bodily Injury Claims Specialist

Receptionist

Senior Project Manager - Vulnerability Management

Senior Manager, Security Incident Response

Senior Manager, Security Incident Response

Community Lead & Field