Security Architect

Company Description

BlueScope is an Australian born, global success story, spanning 18 countries, with a team of over 16,500 people. We’re driven by innovation and are proud that the technologies in our products and brands, like COLORBOND® steel, inspire and protect everything from hospitals and bridges to stadiums and homes.

Job Description

The Enterprise Security function delivers security architecture, engineering and strategy for BlueScope, helping protect our IT and operational technology environments and support safe, reliable operations.

We are seeking an experienced Security Architect for a 12 month fixed term contract to design, engineer and integrate security solutions across BlueScope’s systems, applications, infrastructure and delivery environments. Reporting to the IT Manager - Cyber Security Architecture, you will work with enterprise architects, cyber security teams, cloud and platform engineers, project teams, product owners, vendors and business stakeholders to embed secure-by-design principles and translate security requirements into practical, automated controls.

This role can be based in Melbourne (Mount Waverley), Sydney (Mascot) or Wollongong (Port Kembla), with hybrid working and three days per week in the office.

Key Responsibilities

You will combine security architecture expertise with hands on engineering and automation capability to strengthen BlueScope’s security environment. You will develop reusable patterns and guardrails, assess solution risk, integrate security platforms and help ensure controls are codified, tested, monitored and embedded within delivery pipelines.

Responsibilities include:

• Plan, design and govern security architectures across systems, applications, infrastructure, cloud, identity, data, networks, SaaS and API solutions.
• Conduct security assessments, define requirements and recommend practical risk remediation approaches for projects and technology changes.
• Develop and maintain security architecture artefacts, reusable patterns, standards, templates and guardrails under version control.
• Maintain security architecture alignment with enterprise architecture, cyber security strategy, standards and legislative obligations.
• Partner with technology, cyber security, business, vendor and operational technology stakeholders to improve security-by-design adoption and remediation outcomes.
• Contribute to BlueScope’s security uplift roadmap, control health reporting and continuous improvement of security capability.
• Manage security controls as code using Terraform and Azure DevOps templates, including automated policy validation and configuration drift detection.
• Embed automated security testing into CI/CD pipelines, including application, dependency, infrastructure-as-code, container and secrets scanning.
• Integrate security platforms and telemetry, including log and event onboarding to Microsoft Sentinel and connections across security, identity, asset management and IT service management platforms.
• Support security engineering across SIEM and SOAR, endpoint detection and response, vulnerability management, identity governance and the broader security toolchain.

Qualifications

You are a practical and collaborative security professional who can translate architecture into working, integrated capability. You bring:

• At least three years’ experience in a security architecture capacity.
• Proven experience in security threat and risk assessments, policy, architecture and design.
• Security architecture and engineering experience across SaaS, cloud, APIs, identity, threat and vulnerability management, data protection and network protection.
• Hands on experience integrating security platforms such as SIEM and SOAR, endpoint detection and response, vulnerability scanning and identity governance tooling.
• DevSecOps engineering capability, including policy and infrastructure as code, secure CI/CD pipeline design, Git-based workflows, secrets and key management, and container or Kubernetes security.
• Practical automation and integration skills using PowerShell or Python, REST APIs and connectors, together with security telemetry querying such as KQL in Microsoft Sentinel.
• Strong stakeholder engagement, written and verbal communication, analytical and problem solving skills.
• Information security certification such as SABSA, CISSP or SANS, or equivalent demonstrated capability.

Experience in heavy industry such as manufacturing, mining, oil and gas would be highly regarded. A tertiary qualification in IT, computer science or a related discipline, and cloud or DevSecOps certifications such as AZ-500, AWS Certified Security - Specialty, GIAC GCSA or Certified Kubernetes Security Specialist, would also be advantageous

Additional Information

A career at BlueScope provides the opportunity to make a difference - to you, to your team, to our customers, to transforming products, processes and brands, and to an organisation intent on shaping a better built environment for all our communities. At BlueScope, you will:

• make an impact both within the organisation and in the broader community
• create and deliver innovative products and solutions that shape the world we live in
• grow on a path of continuous learning and development
• enjoy the sense of belonging that comes from working with people who genuinely look out for one another

We’re dedicated to supporting our people, keeping one another safe, rewarding successes and helping individuals grow. We foster workplace flexibility and an inclusive work environment that welcomes people of all backgrounds. We’re committed to climate action and to helping shape a better future for all our communities; we are committed to Our Purpose, Creating Strength.

Come and discover us at bluescope.com/life. Together we can make a world of difference.