Security Engineer (Cloud and AppSec)

At RUSH, we design, build, and manage purposeful digital experiences that improve people’s lives.

You'll build the security into the systems we design, build and run for clients, in code and infrastructure as code. You'll start on a large greenfield platform on Microsoft Azure for a major New Zealand client, embedded in its delivery team from design through to production.

This is a senior engineering role with a lot of autonomy: you'll own security design and implementation on your engagements. You'll write authentication and authorisation flows, harden cloud infrastructure, wire security into CI/CD pipelines and build the audit trails and telemetry that let us detect and investigate. Developers and platform engineers moving into security are welcome.

What you'll build

Identity and access

• Build sign-in and federation using Microsoft Entra ID B2C and OpenID Connect integration with client identity platforms (Entra External ID).
• Implement MFA flows (e.g. AuthSignal) and SCIM provisioning.
• Build role-based and field-level permission models in code, so access is enforced consistently across every part of the system.
• Build session and token handling: HTTP-only cookies, HTTPS-only transport, idle timeout and server-side revocation.

Application security

• Implement input validation and output encoding against SQL injection, XSS and the rest of the OWASP Top 10, on client and server.
• Implement malware scanning on every file upload path.
• Secure API authentication, authorisation and integration points with external systems.
• Manage secrets and certificates through Azure Key Vault, removing them from code and config.

Cloud hardening, as code

• Configure Azure WAF (Application Gateway), Azure Front Door and DDoS protection through infrastructure as code (Bicep or Terraform).
• Set secure baselines with Microsoft Defender for Cloud, and fix what Wiz finds across development, staging, UAT and production.
• Build privileged access controls: bastion hosts, VPN, segregation of duties and privileged device baselines.
• Protect non-production environments to production standards, or build the anonymisation pipeline that makes production data safe to use.

Pipeline security

• Integrate SAST and DAST into Azure DevOps pipelines, scanning every build and failing on high-severity findings.
• Tune the tooling so findings are actionable, and help developers fix them.

Audit logging and detection

• Build audit trails that record who changed what, when, and the before and after state.
• Ship infrastructure and application logs to long-term retention, with export.
• Instrument the system and write detections (KQL in Azure Monitor) so attacks are visible.
• Investigate, contain and fix incidents at code and infrastructure level, and keep the incident runbook tested for fast P1 response.

Security leadership in delivery

• Own security design decisions on your engagements, approving security-relevant architecture before it's built.
• Lead threat modelling at design and sprint planning, using OWASP and NIST SSDF.
• Write security stories and acceptance criteria into the backlog, so security ships in every sprint.
• Review security-sensitive code, pair with developers on fixes, and lift the delivery team's security capability.
• Act as the security technical lead for client engineering teams.

Working with the GRC and security operations team

We're a small team, so you'll sometimes help out beyond engineering. It isn't the core of the role, but expect to work with the GRC and security operations team on:

• compliance evidence for the controls you build (ISO 27001, SOC 2, tracked in Vanta)
• technical answers for client security questionnaires and audits
• scoping penetration tests and fixing their findings
• monitoring, incident response exercises and incident response for systems you've built

You'll need

• 5+ years in software, platform or security engineering, including at least 2 focused on security, shipping production code in a team.
• A track record of owning security design and implementation.
• Strong coding in at least one mainstream language (e.g. C#, TypeScript, Python).
• Infrastructure as code (Bicep or Terraform) on Microsoft Azure.
• Deep hands-on Azure: networking, Entra ID, Key Vault, WAF, Front Door and Defender for Cloud.
• A strong understanding of OAuth 2.0, OpenID Connect, SAML, SCIM, RBAC and MFA flows.
• Knowledge of the OWASP Top 10 and how to prevent each class in code.
• CI/CD experience, ideally Azure DevOps, and scripting in PowerShell or Python.

Nice to have

• KQL and Azure Monitor or Log Analytics.
• Wiz or another cloud security posture tool (Prisma Cloud, Orca).
• SAST and DAST tooling (SonarQube, Checkmarx, Burp Suite, OWASP ZAP).
• NIST SSDF, and experience fixing penetration test findings.
• Exposure to ISO 27001 or SOC 2.
• Certifications such as AZ-500, SC-200 or OSWE, or a bug bounty, CVE or CTF track record.