Application Security Engineer

About the Role

We are looking for a seasoned Application Security Engineer based in Singapore with 7 to 10 years of experience to enhance our security posture through application security testing, malware and CBOM capabilities, vulnerability assessments, remediation efforts, and security automation.

Key Responsibilities

• Develop and improve capabilities related to malware code detection, CBOM, and overall application security.
• Conduct thorough security assessments and evaluate vulnerabilities based on their severity, exploit potential, and business implications.
• Review source code, analyze logs, examine software dependencies, and investigate technical security findings.
• Distinguis false positives and duplicate vulnerability reports.
• Verify remediation effectiveness by retesting and advise on corrective measures.
• Automate security workflows and integrate various security tools and platforms.
• Manage vulnerability remediation tracking and risk disposition processes.
• Prepare detailed security documentation for governance reviews and engage with stakeholders to communicate findings and status.

Qualifications & Skills

• Proficient in Application Security Testing methodologies including SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and SCA (Software Composition Analysis).
• Knowledgeable about CBOM/SBOMs, software components, and managing risks associated with dependencies.
• Strong grasp of Secure Software Development Life Cycle (Secure SDLC) and application security fundamentals.
• Experienced in reviewing source code and assessing vulnerabilities.
• Competent in scripting and automation using Python, PowerShell or similar languages.
• Familiar with security reporting, analytics, and the management of vulnerabilities.
• Possess excellent analytical abilities, communication skills, and experience managing stakeholder relationships.

Preferred Credentials

• Certifications such as CEH, GWAPT, CSSLP, OSCP, or equivalent security qualifications.
• Hands-on experience with malware/malcode analysis and securing the software supply chain.
• Proven track record supporting large-scale enterprise application security initiatives.