General information

Country: Singapore

Creation Date: 28-Jul-2026

Employment Type: Permanent

Employment Type: Full time

Ref #: 1234573327

Description & Requirements

We're looking for an Application Security Engineer with a DevSecOps mindset to help us build security into every stage of our software development lifecycle across our APAC insurance markets. You'll partner with engineering teams to shift security left, automate security controls, and ensure our applications and infrastructure remain resilient against evolving threats - while meeting the cyber and technology risk expectations of insurance regulators across the region. This is a hands-on role for someone who enjoys writing code, breaking things (responsibly), and empowering developers to ship secure software at speed.

Your work will support compliance with cyber and technology risk requirements issued by insurance regulators in our APAC markets, including:

• Singapore - Monetary Authority of Singapore (MAS): Notice 127 on Cyber Hygiene, TRM Guidelines
• Hong Kong - Hong Kong Insurance Authority (HKIA): GL20 on Cybersecurity
• Australia - Australian Prudential Regulation Authority (APRA): CPS 234 (Information Security), CPS 230 (Operational Risk Management)
• Malaysia - Bank Negara Malaysia (BNM): Risk Management in Technology (RMiT)
• China - National Financial Regulatory Administration (NFRA)
• India - Insurance Regulatory and Development Authority of India (IRDAI): Information and Cyber Security Guidelines

Responsibilities:

• Design, implement, and maintain security automation across CI/CD pipelines, including SAST, DAST, and secret detection
• Conduct secure code reviews for change deployments and new designs - review pull requests, release candidates, and infrastructure changes to identify security defects before they reach production; provide actionable, context-rich feedback that helps developers ship securely and on time
• Partner with engineering teams to perform threat modeling, secure code reviews, and architecture risk assessments for new features, services, and system designs - ensuring security is embedded from the earliest design stages through implementation
• Triage, prioritize, and remediate vulnerabilities discovered through automated tooling, bug bounty programs, and penetration tests
• Build and maintain secure-by-default frameworks, libraries, and paved-road templates that make the secure path the easy path for developers
• Develop, maintain, and continuously improve SOPs and guidelines for DevSecOps - define standardised operating procedures covering secure development lifecycle, pipeline security gates, vulnerability handling workflows, secure release processes, and incident response playbooks; ensure guidelines are practical, adopted by engineering teams, and aligned with regulatory expectations
• Ensure AppSec controls and evidence support the regulatory obligations of our APAC markets (e.g., APRA CPS 234 information security capability, MAS TRM secure development, BNM RMiT software lifecycle controls)
• Develop and deliver security training and documentation to raise the security baseline across engineering
• Respond to security incidents, conduct root cause analysis, and drive systemic improvements
• Contribute to our vulnerability management program, including SLAs, metrics, and reporting to engineering leadership and to GRC teams supporting regulatory submissions
• Escalate unresolved security issues and non-compliances to the CISO - identify and formally escalate risks that remain unresolved beyond defined SLAs, regulatory non-compliances, or exceptions that exceed accepted risk appetite, ensuring executive visibility and timely decision-making
• Champion a healthy security culture through collaboration rather than gatekeeping

Experience & Qualification Requirements:

• 5+ years of experience in application security, software engineering, or a closely related field
• Strong understanding of OWASP Top 10, CWE/SANS Top 25, and common web/API attack patterns
• Hands-on experience integrating security tooling into CI/CD pipelines (GitHub Actions, Contrast, Rapid7, Tenable, Wiz, Codacy, CodeQL, Jenkins, etc.)
• Proficiency in modern programming languages (Python, TypeScript/JavaScript, Java, or similar)
• Working knowledge of cloud security in AWS, Azure, including IAM, network controls, and container security
• Experience performing threat modeling using frameworks like STRIDE.
• Awareness of cyber and technology risk regulations applicable to insurers in APAC (MAS, HKIA, APRA, BNM, NFRA, IRDAI)
• Strong written and verbal communication skills, especially when explaining security concepts to non-security audiences
• Experience with bug bounty programs, red team engagements, or offensive security
• Contributions to open-source security tools or published security research
• Familiarity with SBOM, SLSA, sigstore, or other supply chain security initiatives
• Relevant certifications (OSCP, OSWE, AWS Security Specialty, or equivalent)
• Background in regulated environments - insurance, banking, or other financial services preferred