Senior Security Engineer (AppSec / DevSecOps)
Role overview
Deskripsi pekerjaan
This role builds and runs the security function as its first dedicated Security Engineer, reporting to the VP of Technology. It covers threat modelling across applications, infrastructure, repositories, and third-party integrations, prioritizing security risks, and triaging vulnerability and security-monitoring findings. The role handles security incidents end to end, reviews code and architecture with developers, and defines security standards engineers can follow.
It also coordinates remediation with DevOps and development squads and works with GRC so that security controls and evidence meet compliance requirements.
Tanggung jawab
Responsibilities
- Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.
- Own security risk scoring and the risk register, so that severity reflects real business impact.
- Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escalate only what matters
- analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
- Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
- Review code and architecture for security risks, and work with developers to fix them.
- Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
- Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
- Work with GRC so that security controls and evidence meet compliance requirements
- coordinate with DevOps and development squads, who own remediation under our agreed SLA.
Yang perlu disiapkan
Job requirements
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
- Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
- Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
- Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
- Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
- Experience handling real security incidents and writing post-incident reviews.
- Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
- Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.
Kualifikasi kandidat
Skill dan kualifikasi
- Experience scoping and managing penetration tests with external vendors is an advantage.
- Knowledge of compliance frameworks (ISO 27001, SOC 2, NIST Cybersecurity) is an advantage.
- Good communicator who can influence engineers without formal authority. Fluent in English and Bahasa Indonesia.
- Comfortable building from zero, with a strong sense of ownership. You will be the only security engineer at first.
- Certifications such as OSCP, OSWE, CKS or CISSP are a plus, but demonstrated experience matters more.
Tools
Tech stack dan tools
Sebelum klik lamar
Ambil keyword
Catat skill, tools, dan tanggung jawab yang berulang di lowongan ini.
Sesuaikan CV
Tulis ulang pengalaman agar lebih nyambung dengan kebutuhan role.
Kirim dengan konteks
Gunakan cover letter singkat yang menyebut kebutuhan perusahaan.
Jubelio
Jakarta Selatan
AI Job Match Score
Cocokkan CV kamu dengan lowongan ini sebelum melamar.
CV Pintar menampilkan lowongan sebagai referensi. Selalu cek detail terbaru di sumber asli sebelum melamar.
Ubah detail lowongan ini jadi CV yang lebih relevan.
Gunakan CV Pintar untuk scoring ATS, keyword extractor, dan cover letter yang mengikuti konteks role ini.