Senior Engineer, Information Security

Why this QUT security posting lands differently in 2026

Queensland University of Technology wants a Senior Engineer, Information Security. The posting, reference 26543, sits in Digital Business Solutions and pays a total package of $138,193 to $156,633 a year, made up of a base salary of $116,774 to $132,357, 17 per cent superannuation and 17.5 per cent leave loading. Applications close at 11.30pm on 28 October 2026. If you've been watching Australian university security from outside the sector, that two-week window is the first signal QUT is moving faster than universities typically do.

Australian universities have spent the past three years learning, repeatedly, that they are data-rich targets in ways attackers understand better than many councils do. In December 2025, the University of Sydney disclosed a breach of an online code repository that exposed personal information belonging to more than 27,000 current and former staff, students and alumni. The University of Western Australia reset passwords for its community in August 2025 after unauthorised access to password information. Western Sydney University disclosed in October 2025 that an attacker had been present inside a third-party cloud file-sharing system from June to September, taking data on roughly 10,000 current and former students, with an 11-week dwell time before detection.

Those are not isolated events. They are the context in which a senior security engineer at a Brisbane university now works.

The regulatory load universities carry

In 2018, the Security of Critical Infrastructure Act, known inside the sector as the SOCI Act, was amended to bring higher education and research into the critical infrastructure framework. That change introduced mandatory cyber incident reporting through the Cyber and Infrastructure Security Centre, with significant incidents reportable within 12 hours and relevant incidents within 72 hours. The centre has been blunt about compliance: in the 2023-24 financial year, almost 30 per cent of mandatory cyber incident reports across critical infrastructure arrived late, and higher education's late-reporting rate sat at around 25 per cent.

Layered on top is the Australian Cyber Security Centre's Essential Eight, the eight baseline mitigation strategies Australian institutions use as their yardstick: patch applications, patch operating systems, multi-factor authentication, restrict administrative privileges, application control, restrict office macros, user application hardening and regular backups. The Australian public service has required maturity level two since July 2022. Universities, regulated under the Tertiary Education Quality and Standards Agency rather than the Protective Security Policy Framework, have largely adopted the same model as their bar for defensible operations. A university hiring a senior security engineer is often hiring someone to close documented gaps against exactly that framework.

What the role actually is

The role sits inside Digital Business Solutions, or DBS, the QUT division that runs technology for staff and students across learning and teaching, research, and the professional services that keep the institution running. It reports to the Manager, Information Security Operation Centre. Day to day, you will identify, assess, report and respond to cyber threats and breaches of IT security policy, and help evaluate new strategies for cyber security risk. The posting is explicit that this is hybrid work based at Kelvin Grove campus, a few kilometres north of Brisbane's central business district.

QUT has also run a related Senior Information Security Operations Engineer role under reference 26538, sharing the same manager and operations centre. The engineer posting here leans broader, toward security engineering across the university's digital ecosystem rather than operations only. The selection criteria run in two streams. First, you need postgraduate qualifications or progress toward them plus experience delivering information security support in a complex environment, and depth in at least three areas drawn from systems administration, cloud administration on AWS or Azure, communication and network security, software development security, identity and access management, and security architecture. Second, you need hands-on knowledge of controls: SIEM platforms, firewalls, intrusion detection systems, endpoint detection and response, email defence and vulnerability management. Add scripting, operational technology awareness and proven incident response, and the picture is a generalist senior engineer rather than a narrow specialist.

What makes a university post noticeably harder than a corporate one is that the environment deliberately opens doors to researchers, campus clinics, commercial partners and external collaborators. Securing that kind of ecosystem is a different discipline from locking down a closed corporate network, and it is why QUT's division runs awareness work as well as engineering work.

A closer look at the day-to-day of university security operations, and the fit with QUT's team, sits in the earlier piece Senior Engineer, Information Security at QUT: Role Explained.

The market you are competing in

Jobs and Skills Australia counted roughly 70,900 people employed as database and systems administrators and ICT security specialists in August 2025, up by 3,300 over the year, and projected 14.2 per cent growth in that occupation group between May 2024 and May 2029, more than double the national average of 6.6 per cent. The Australian Information Security Association keeps warning that the country cannot fill senior security roles from the current pipeline, with women making up about 17 per cent of the cyber security workforce. AustCyber's earlier projection of a domestic shortage of 3,000 cyber security workers by 2026 has become the sector's working assumption.

Money in Brisbane varies because the figures blend private and public employers. ERI's January 2025 estimate puts the average information security engineer salary in Brisbane at AUD 159,599, within a range from AUD 110,283 to AUD 194,711. Glassdoor places the middle base-pay band for security engineers across Australia between roughly AUD 107,750 at the 25th percentile and AUD 174,450 at the 75th. A private-sector senior cyber security engineer role advertised in Brisbane in December 2025 carried AUD 150,000 to AUD 160,000 plus superannuation. QUT's total package of AUD 138,193 to AUD 156,633 sits below the private tip but carries 17 per cent super, worth several thousand more than the standard guarantee.

A security engineer I worked alongside, call him Dr. M, took a university job partly for that super payment and partly because he wanted to protect students and research rather than a corporate balance sheet. He lasted two years. What ground him down was not the tooling; it was that the operations centre ran on three people and a rotating cast of contractors, which meant every overnight alert went to the same phones. The base rate in the sector is that senior security roles get advertised because a gap already existed, not because a new one opened. QUT's posting is an exception in one respect: the position description names the team and the reporting line up front, which tells you more than many university listings do.

What this means for your application

QUT runs applications through its e-recruitment system under reference 26543, opened on 14 October and closing at 11.30pm on 28 October 2026. The terms matter as much as the pay. The role is ongoing full-time, offered hybrid, and open only to applicants with ongoing full-time work rights in Australia, with no visa sponsorship. Aboriginal Australians and Torres Strait Islander people are explicitly encouraged to apply, in line with QUT's Indigenous Australians Employment Strategy target of 3.6 per cent workforce participation.

University panels score against selection criteria, so treat each criterion as a brief. For each capability in the position description, pick the single strongest incident or project you led and attach a number: detections tuned, mean time to contain before and after, accounts remediated, or the dollar value of an incident you stopped. Write the cover letter last, and keep it to who you are, the two capabilities that make you the right hire, and one sentence about why securing a university specifically matters to you.

Before you invest hours, ask the contact officer a few direct questions. Which SIEM and EDR are deployed, and how much infrastructure sits in cloud tenants versus on-premises? How many engineers carry the operations centre, and who backs you up at two in the morning? If you would be the only senior engineer on a team of two, that is a different job from one on a team of ten, and the pattern of answers tells you how much of your week will be engineering versus firefighting.

Every large Australian university breach in the past three years has a version of the same postmortem: a system that held personal data too long, a third party with standing access, a password file that predated multi-factor authentication. This fortnight, pull the position description and write down three incidents you personally led, with the number that proves each one. If you cannot produce three, you already know what to work on.