DevSecOps Engineer - Application Security
Prudential · Kuala Lumpur (Group Head Office)
Full-timeonsitemidTechTechnology
รายละเอียดงาน / Description
Based in Malaysia, this role joins the Vulnerability Operations Centre to validate, prioritize, and remediate application security risks across global business units. The engineer will triage security testing outputs, evaluate business impact, and design automated workflows to streamline vulnerability lifecycles. Working closely with cross-functional development and DevOps teams, the position ensures secure coding standards and modern DevSecOps integration.
หน้าที่ความรับผิดชอบ / Responsibilities
- Triage and analyze vulnerability findings from various application security testing tools
- Prioritize security issues based on exploitability, asset criticality, and business context
- Build and implement automation workflows for vulnerability enrichment, de-duplication, and ticketing
- Partner with developers, DevOps, and security leads to explain risks and advise on remediation
- Evaluate and integrate open-source and commercial security testing tools into existing pipelines
- Document standard operating procedures, playbooks, and knowledge base records for vulnerability operations
คุณสมบัติ / Qualifications
- Bachelor’s degree in Information Security, Computer Engineering, or a related discipline
- At least four years of cybersecurity experience focusing on application security or vulnerability management
- Strong background in web application and API security fundamentals, including OWASP Top 10 and CWE
- Practical scripting skills in Python, JavaScript, PowerShell, or Bash for workflow automation
- Familiarity with multi-cloud environments such as AWS, Azure, or GCP and modern DevSecOps tooling
- Relevant industry certifications such as CISSP, OSCP, or Security+ are advantageous
ทักษะที่ต้องการ / Required skills
- DevSecOps
- Application Security
- Vulnerability Management
- OWASP
- Python
- Bash
- Cloud Security
- SAST
- DAST
ทักษะเพิ่มเติม / Nice to have
- CISSP
- OSCP
- Security+
- Threat Modeling
- ISO 27001
- NIST