Senior Cybersecurity Engineer

Senior Cybersecurity Engineer

Philippines (remote) · Full-time · Reports to the Head of Technology

About Voltex

Voltex Electrical is an electrical wholesale distributor that serves electricians across Australia and New Zealand. We sell direct to the trade, and our customers order from us every week. The business is growing fast, and technology is central to how we get there.

The Role

You will be part of a high-performance team who operate in a fast paced environment, this is a hands-on engineering role. Security testing of websites, web applications, APIs, and mobile apps is a core responsibility alongside our identity, endpoint, cloud, and network security. You find weaknesses, rank them by business risk, and fix them or work with the teams that own the systems to verify the fix.

You sit outside the infrastructure team to provide independent security challenge. Your job in year one: make the business measurably safer and give the Head of Technology an evidence-based view on priorities, residual risk, and where specialist support or additional capacity is needed.

What you will do

• Manually test public-facing and internal web applications and APIs, including authenticated journeys, authentication, sessions, object and role authorization, tenant boundaries, and business-logic abuse. Use scanners to support, not replace, manual investigation.
• Assess mobile apps on the platforms we use, including local storage and logging, authentication and sessions, network trust, platform interactions, and their backend APIs. Identify where deeper specialist testing is needed.
• Review relevant source code, configuration, and designs with developers. Build practical threat modelling, security checks, and regression tests into the development lifecycle, including code, dependency, and secrets scanning in CI/CD.
• Document reproducible findings and business impact, agree remediation owners and dates, help developers fix root causes, and independently retest their fixes. Track coverage, overdue risks, and time-bound risk exceptions with the Head of Technology.
• Agree written scope and authorisation before testing, including environments, test accounts and data, production safeguards, and stop conditions. Protect customer information and avoid disruption.
• Own security posture in Microsoft Entra ID and Microsoft Defender: Conditional Access, multi-factor authentication coverage, privileged access, and alert routing.
• Run incident response for security events, from detection through to the post-incident review.
• Review security-relevant application, access, network, and infrastructure changes before release, and act as the named security approver for high-risk changes. Arrange separate review of your own high-risk changes and escalate unresolved release risks to the Head of Technology.
• Enforce secrets and identity hygiene for people, workloads, and AI agents: Azure Key Vault, managed identities, no embedded credentials, least privilege for every integration.
• Investigate account takeover and fraud signals with our QA and Customer Service teams, and close the gaps they expose.
• Run security awareness and phishing resistance for Voltex staff.

How to Apply

Send your CV and a short, sanitised example of a web, API, or mobile vulnerability you personally investigated. Explain what you tested, the business impact, your role in remediation, and how the fix was retested. Do not include client data or confidential code. Be ready to walk through your evidence and an authorised practical scenario at interview. Alternatively applying through Linkedin is fine as well

Requirements:

What you bring

We value proven, hands-on ability more than any one certification. Application testing and the ability to drive fixes through retest are essential. You should be able to show:

• Web and API security — personally investigating and validating weaknesses in authenticated websites, web apps, and APIs, including authorisation and business logic, using an intercepting proxy such as Burp Suite or an equivalent tool.
• Mobile application security — hands-on assessment of mobile-client security and backend APIs on relevant platforms, with a clear understanding of your testing limits.
• Code review and remediation — reading source and configuration, explaining root causes, working with developers on fixes, and verifying retests and regression coverage. Our web stack includes .NET/IIS; strong transferable experience is welcome.
• Cloud and on-premises security — securing Microsoft Azure workloads and hybrid estates — cloud resources alongside on-premises servers and Active Directory.
• Identity — Entra ID administration, Conditional Access design, MFA rollout, and privileged access management.
• Endpoints — Microsoft Defender and EDR platforms (we run CrowdStrike), plus device management with Intune.
• Network security — firewalls, segmentation, and SASE/SD-WAN environments (we run Cato).
• Incident response — detection, containment, and clear post-incident write-ups.
• Frameworks — using OWASP guidance to structure application testing and the ASD Essential Eight or a comparable framework to turn broader security controls into practical work.

You communicate risk in plain business terms, work well remotely across AU/NZ time zones, and can operate independently as the sole security specialist. We expect sound judgement across the wider estate, not expert-level experience with every named product.

Nice to have

• Security certifications such as AZ-500, SC-200, or equivalent experience.
• Experience securing data platforms (we run Databricks) or governing AI tool and agent access.
• Experience running phishing simulation and security awareness programmes.
• Deeper native mobile testing, reverse engineering, or experience commissioning and validating specialist penetration tests.

Benefits:

• Fully WFH with flexible working hours
• Paid Parental Leave
• Annual and sick Leave - 20 Service Inventive Leave (SIL) days per year
• Healthcare - HMO Coverage for up to four (4) dependants
• Monthly food allowance