API & Platform Engineer - 12 Month Fixed Term Contract

Company Description

We’ve been around since 1988, and today we’re one of Australia’s largest profit‑to‑member super funds.

That means everything we do is focused on delivering better outcomes for our members – not shareholders.

Closing date: 14 October 2026

Please note Rest does not accept speculative resumes from recruitment agencies

Rest will review applications prior to the closing date and may close the role earlier

Job Description

• Help protect technology that supports the financial wellbeing of millions of Australians.

• Take ownership of high-impact application, API and platform security remediation across a modern technology environment.

• Sydney CBD Office Located, Hybrid Working

At Rest, we help more than 2 million Australians to build a better financial future. With around $112 billion in funds under management, we focus on delivering strong long-term outcomes for our members — from their first job through to retirement*. Your best at Rest means focusing on what matters, being trusted to get on with it, and knowing your work genuinely makes a difference. That’s how we operate every day, guided by our values: Be Daring, Keep It Simple, Take Action and Have Grit.

Join us as a API & Platform Engineer on a 12 Month Fixed Term Contract.

In this role you will own and perform risk-prioritised remediation of application code, dependency and repository security findings across API and platform engineering. Strengthen GitHub and CI/CD practices so vulnerabilities are effectively closed and recurring risks are reduced through secure controls, guardrails and engineering patterns.

Accountabilities/Responsibilities

• Own and perform hands-on remediation of prioritised application code findings identified through SAST, DAST and other security tooling, and verify effective closure.
• Remediate vulnerable open-source and third-party dependencies identified through SCA, including upgrades, replacement or removal, with evidence that the risk has been resolved.
• Strengthen repository security by addressing exposed secrets, insecure configuration, excessive access, missing branch and pull-request protections, and unsafe workflow settings.
• Partner with platform, application and product teams where remediation depends on service ownership, coordinating action and validating closure.
• Improve GitHub and CI/CD security through secure repository baselines, reusable workflows, automated SAST, DAST and SCA integration, secrets protection, dependency controls and quality gates.
• Identify recurring weaknesses and document practical controls, guardrails, secure engineering patterns, remediation standards, playbooks and governance evidence.
• Lead platform and application security risk exemptions by assessing residual risk, documenting business justification and compensating controls, coordinating approvals, and monitoring review and expiry

Qualifications

Experience, skills and qualifications

• Hands-on experience implementing security fixes across modern application and API codebases, with strong development and scripting capability in Node.js, TypeScript and Python.
• Strong understanding of SAST, DAST and SCA findings, including practical remediation of vulnerable code, open-source dependencies and third-party packages.
• Practical GitHub administration and security experience covering repository governance, access controls, branch protection, pull-request requirements, GitHub Actions and secrets management.
• Experience with cloud-native platforms, APIs, containers, serverless services and infrastructure as code.
• Knowledge of the OWASP Top 10, common CWEs, secure code remediation and software supply-chain security.
• CI/CD security engineering experience, including automated security testing, reusable GitHub Actions workflows, quality gates, vulnerability management integration and validation of remediation outcomes.
• Ability to translate security findings into clear, practical remediation requirements for engineers, platform owners and product teams.

Additional Information

.What you'll find at Rest

• Hybrid working
• 5 Rest Days (wellbeing days) each year in addition to annual leave
• Eligible employees are entitled to 22 weeks paid parental leave (gender neutral)
• Continued super contributions during parental leave
• Learning and development opportunities, including AI & Data Academy, leadership programs, LinkedIn Learning, study assistance and professional memberships
• Income Protection Insurance
• Option to purchase additional leave
• Recognition through our Rest Excellence Awards

If you share our values and this sounds like the kind of place you’d do your best work, we’d like to hear from you. Apply now.

Rest is committed to creating a flexible work environment and culture that embraces diversity, equity, and inclusion - where people feel welcome, safe to be themselves and inspired to do their best.

We value the different backgrounds, lived experiences and abilities our diverse team brings. We welcome and encourage applications from candidates of all ages, cultural backgrounds, faiths, gender identities, sexual orientations and thinking styles. This includes people with disability, neurodiverse individuals, Aboriginal & Torres Strait Islander peoples and those with disrupted work history due to career or other breaks.

We welcome applications from all candidates. To be considered, you will need the right to work in Australia.

*Funds under management as at 30 June 2026. Rest is recognised as a superannuation leader across a range of areas including performance, responsible investment and member value. Find out more at https://rest.com.au/why-rest/awards.