Application Security Engineer

About the role

The Application Security Engineer will secure web applications, APIs, and backend services while coordinating with mobile stakeholders on cross-platform risks. This role involves embedding security into design, development, testing, and release workflows to ensure robust protection of financial applications.

Responsibilities

• Perform security reviews, code reviews, and testing for web applications, APIs, and backend services.
• Identify, prioritize, and help remediate injection, broken access control, authentication, and configuration vulnerabilities.
• Integrate SAST, DAST, software composition analysis, and secrets scanning into CI/CD pipelines.
• Conduct threat modeling and design reviews for features, APIs, third-party integrations, and major changes.
• Coordinate with mobile engineers on cross-platform findings and backend controls protecting native iOS and Android clients.
• Own application security implementation for SC TRM and BNM RMiT, including secure SDLC evidence, vulnerability management, testing, and audit remediation.
• Provide secure coding guidance, track remediation, retest fixes, and improve developer security awareness.

Required skills

• Application security
• Penetration testing
• Secure software development
• OWASP Top 10
• OWASP API Security Top 10
• API security
• Secure design
• Burp Suite
• OWASP ZAP
• SAST
• DAST
• TypeScript
• Node.js
• Python

Nice to have

• Swift
• Kotlin
• AWS
• GCP

Qualifications

• Degree in Computer Science, Cybersecurity, or related discipline
• Equivalent practical experience

About the Company

Bjak is a leading insurance platform in Southeast Asia that aims to help people plan, save, and grow their money. Founded in 2019, the company provides mobile-first financial applications and operates with a global team across multiple offices.