Senior Security Engineer (AppSec / DevSecOps)

Tanggung Jawab

Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.

Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.

• Own security risk scoring and the risk register, so that severity reflects real business impact.
• Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escalate only what matters.
• Analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
• Review code and architecture for security risks, and work with developers to fix them.
• Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
• Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
• Work with GRC so that security controls and evidence meet compliance requirements.
• Coordinate with DevOps and development squads, who own remediation under our agreed SLA.

Kualifikasi

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
• Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
• Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
• Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
• Experience handling real security incidents and writing post-incident reviews.
• Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
• Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.