General information

Country: Malaysia

Creation Date: 28-Jul-2026

Employment Type: Permanent

Employment Type: Full time

Ref #: 1234573327

Description & Requirements

Job location: Singapore / Hong Kong / Malaysia / India

We're looking for an Application Security Engineer with a DevSecOps mindset to help us build security into every stage of our software development lifecycle across our APAC insurance markets. You'll partner with engineering teams to shift security left, automate security controls, and ensure our applications and infrastructure remain resilient against evolving threats - while meeting the cyber and technology risk expectations of insurance regulators across the region. This is a hands-on role for someone who enjoys writing code, breaking things (responsibly), and empowering developers to ship secure software at speed.

Your work will support compliance with cyber and technology risk requirements issued by insurance regulators in our APAC markets, including:

Singapore - Monetary Authority of Singapore (MAS): Notice 127 on Cyber Hygiene, TRM Guidelines
Hong Kong - Hong Kong Insurance Authority (HKIA): GL20 on Cybersecurity
Australia - Australian Prudential Regulation Authority (APRA): CPS 234 (Information Security), CPS 230 (Operational Risk Management)
Malaysia - Bank Negara Malaysia (BNM): Risk Management in Technology (RMiT)
China - National Financial Regulatory Administration (NFRA)
India - Insurance Regulatory and Development Authority of India (IRDAI): Information and Cyber Security Guidelines

Responsibilities:

Design, implement, and maintain security automation across CI/CD pipelines, including SAST, DAST, and secret detection
Conduct secure code reviews for change deployments and new designs - review pull requests, release candidates, and infrastructure changes to identify security defects before they reach production; provide actionable, context-rich feedback that helps developers ship securely and on time
Partner with engineering teams to perform threat modeling, secure code reviews, and architecture risk assessments for new features, services, and system designs - ensuring security is embedded from the earliest design stages through implementation
Triage, prioritize, and remediate vulnerabilities discovered through automated tooling, bug bounty programs, and penetration tests
Build and maintain secure-by-default frameworks, libraries, and paved-road templates that make the secure path the easy path for developers
Develop, maintain, and continuously improve SOPs and guidelines for DevSecOps - define standardised operating procedures covering secure development lifecycle, pipeline security gates, vulnerability handling workflows, secure release processes, and incident response playbooks; ensure guidelines are practical, adopted by engineering teams, and aligned with regulatory expectations
Ensure AppSec controls and evidence support the regulatory obligations of our APAC markets (e.g., APRA CPS 234 information security capability, MAS TRM secure development, BNM RMiT software lifecycle controls)
Develop and deliver security training and documentation to raise the security baseline across engineering
Respond to security incidents, conduct root cause analysis, and drive systemic improvements
Contribute to our vulnerability management program, including SLAs, metrics, and reporting to engineering leadership and to GRC teams supporting regulatory submissions
Escalate unresolved security issues and non-compliances to the CISO - identify and formally escalate risks that remain unresolved beyond defined SLAs, regulatory non-compliances, or exceptions that exceed accepted risk appetite, ensuring executive visibility and timely decision-making
Champion a healthy security culture through collaboration rather than gatekeeping

Experience & Qualification Requirements:

5+ years of experience in application security, software engineering, or a closely related field
Strong understanding of OWASP Top 10, CWE/SANS Top 25, and common web/API attack patterns
Hands-on experience integrating security tooling into CI/CD pipelines (GitHub Actions, Contrast, Rapid7, Tenable, Wiz, Codacy, CodeQL, Jenkins, etc.)
Proficiency in modern programming languages (Python, TypeScript/JavaScript, Java, or similar)
Working knowledge of cloud security in AWS, Azure, including IAM, network controls, and container security
Experience performing threat modeling using frameworks like STRIDE.
Awareness of cyber and technology risk regulations applicable to insurers in APAC (MAS, HKIA, APRA, BNM, NFRA, IRDAI)
Strong written and verbal communication skills, especially when explaining security concepts to non-security audiences
Experience with bug bounty programs, red team engagements, or offensive security
Contributions to open-source security tools or published security research
Familiarity with SBOM, SLSA, sigstore, or other supply chain security initiatives
Relevant certifications (OSCP, OSWE, AWS Security Specialty, or equivalent)
Background in regulated environments - insurance, banking, or other financial services preferred

Remote job Python Engineering Programme job (1)

Sign up to Job Alerts!

Quantitative Researcher: Systematic Macro & Short-Term Options

Boost your career