search Browse Jobs
Staff Security EngineerCanva · Sydney, au
Canva logo

Canva

company page ↗ Visa Sponsoring Company

Staff Security Engineer

✓ This company has sponsored visas before. The posting doesn't say so, but it's still worth applying.

🗓️ Posted 2026-09-12 Sydney, au Full-time Hybrid ICT
💰 Salary Not shared 📊 Market A$15,000–A$22,000/mo

About the Company

Canva is redefining how the world experiences design. The Security Group protects Canva's systems and data from information security threats, across Application Security, Risk Management, Enterprise Security, and Threat Detection and Response. Internal Systems Security is the team focused on Canva's own environment.

About the Job

The Internal Systems Security team secures the environment Canvanauts work in every day, including laptops, networks, identities, SaaS tools, and AI agents. This role is a Staff level individual contributor position, where you will set technical direction without managing others, focusing on proactive security solutions for evolving challenges like AI agents and modern tooling.

Role & Responsibilities

  • ● Go out to teams across the business, work out where their real risks sit, and build the roadmap with them rather than handing them one.
  • ● Help those teams turn on AI workflows safely, instead of being the reason they can't.
  • ● Review new tools and agents before they land, providing approval with necessary settings.
  • ● Threat model newer patterns like MCP, agentic workflows and SaaS to SaaS integrations, then turn what you find into controls people adopt.
  • ● Set the standards other teams build against, and automate the work so a multiplying workload doesn't need a bigger team.

Requirements

Certifications

  • ● macOS at fleet scale: device trust, posture signals, zero trust, certificate-based device attestation (nice to have).

Skills

  • ● You go looking for problems, can point to something you found yourself, got other people to care about, and saw through to a fix.
  • ● You can bring people with you and have convinced an IT or engineering lead to take on something that wasn't on their roadmap, without a mandate.
  • ● You've done hands-on enterprise, corporate or internal security engineering, and built and run security services in production (endpoints, networks, identity, SaaS estates).
  • ● You value concepts over tools, understanding why a control works more than just knowing the tooling.
  • ● You write and review code to a standard other engineers trust, and you automate by default.
  • ● Security work across a broad enterprise, especially somewhere less obvious like marketing or sales (nice to have).
  • ● SaaS security posture: configuration baselines, SSPM, OAuth and third party integration risk, non-human identities (nice to have).
  • ● Securing AI agents, MCP servers or agentic workflows: action level policy, tool call mediation, audit trails and containment (nice to have).
Show 2 more
  • ● Terraform, Python or Go, and cloud in AWS or GCP (nice to have).
  • ● This role is based in Sydney, and we're looking for someone who calls it home.

Benefits

  • ● Hybrid way of working that gives flexibility to work remotely and come together on campus for meaningful in-person collaboration.
  • ● Range of benefits to set you up for success.