Senior Platform Development Engineer

Security Solution Consultants is a cyber security advisory firm operating across Australia and New Zealand. Alongside our consulting practice we build and run our own security software:

GRCLens, a multi tenant governance, risk and compliance platform, and EASMLens, an external attack surface management platform. Both are live, revenue-generating products used by client organisations in regulated industries.

This role is the part of existing devlopers team. This role has real ownership and visible impact, and the person in it will shape how our platforms are built and operated rather than inheriting someone else’s architecture and maintaining it.

We are looking for a Senior Platform Engineer to take ownership of the engineering and operation of our production platforms. This is a hands on role combining backend development, database engineering, containerised infrastructure and production reliability. You will write code, run the systems that code runs on, and be the person who makes sure both stay healthy.

• Develop backend features across FastAPI services, SQLAlchemy data models and PostgreSQL schema design.

• Work across the front end in React and Next.js when a feature needs it. You do not need to be a designer, but you should be comfortable owning a feature end to end.

• Design and extend for multi-tenant data isolation, authentication, authorisation and audit.

• Integrate with third party APIs and AI services, including prompt design and output validation where AI assists human decisions.

• Own Docker Swarm and Docker Compose deployments, including rolling updates, health checks, service definitions and overlay networking.

• Operate PostgreSQL in production: performance, migrations, backups, restore testing, replication and managed-service migration.

• Manage Azure infrastructure: virtual machines, network security groups, managed PostgreSQL, TLS certificates and cost management.

• Improve deployment pipelines so releases are repeatable, verifiable and safe to roll back.

• Establish monitoring, alerting and health checks so problems are found before customers find them.

• Respond to incidents: diagnose from logs and evidence, fix the cause rather than the symptom, and write it up.

• Verify that backups actually restore. Regularly, not theoretically.

• Maintain runbooks and architecture documentation that another engineer could follow.

• Apply secure development practice across authentication, session handling, secrets management and dependency hygiene.

• Identify and remediate vulnerabilities in our own platforms. We sell security software; ours has to be right.

• Work with the consulting team on customer security questionnaires and assurance evidence about our platforms.

• Five or more years of commercial software engineering experience, with at least 3 years in a senior or lead capacity.

• Strong Python. You should be fluent with a modern async web framework (FastAPI, or Django and Flask with a willingness to move), and comfortable with type-annotated Python.

• Solid PostgreSQL beyond basic CRUD: schema design, indexing, query performance, transactions, migrations, and understanding what happens when things go wrong.

• Practical experience with SQLAlchemy or a comparable ORM, including where an ORM helps and where raw SQL is the right answer.

• Real experience running Docker in production. Building images, multi stage builds, Compose, and an orchestrator (Swarm, Kubernetes or ECS). We use Swarm; transferable orchestration experience is fine.

• Working competence with a major cloud platform, ideally Azure. AWS or GCP experience transfers if you are willing to work in Azure.

• Enough TypeScript and a modern React framework, sufficient to deliver a feature through the UI.

• Comfortable with Linux administration, networking fundamentals, reverse proxies and TLS.

• Genuine debugging and diagnostic discipline. The ability to read a stack trace or a log and find the actual cause rather than guessing.

• Clear written communication. You will document systems, write runbooks, and sometimes explain technical risk to non-technical people.

• Eligibility to work: New Zealand or Australian citizenship, residency, or a valid work visa.

• A security engineering background, or a genuine interest in it. Familiarity with OWASP, vulnerability management, or security tooling such as Nmap and nuclei.

• Experience with Celery, Redis, or other distributed task and scheduling systems.

• Compliance or GRC exposure. Understanding what ISO 27001, SOC 2 or PCI DSS actually require is a significant advantage in this domain.

• Azure-specific experience: managed database services, backup and point in time recovery, cost optimisation.

• Experience integrating LLM APIs into products, including the practical problem of validating model output.

• Holding, or willingness to undergo, a New Zealand or Australian government security clearance.

• Genuine ownership of live, revenue-generating products rather than a small slice of someone else’s system.

• Direct technical influence. The architecture decisions in front of us are real and open, and you will make them.

• A role in a growing security consultancy with an established client base across Australia, New Zealand, Singapore, the UK and the Gulf.

• Flexible working and remote-friendly arrangements.

• Professional development support, including certification funding.

• Remuneration: Market rate

Send your CV and a short note about a production system you have owned to [email protected]. Tell us what broke, and what you did about it.

We review applications as they arrive and will be in touch either way.

Security Solution Consultants is an equal opportunity employer.