Application Security

Permata Bank; Tangerang Selatan; On-site; IDR 300,000,000 - 540,000,000; Full time

Job summary

Permata Bank is seeking a skilled Application Security professional in Indonesia to lead risk-based assessments of web, mobile, and API components, aligning findings with release milestones and business impact. You will review evidence, validate findings, and coordinate remediation with cross-functional teams.

The role emphasizes secure SDLC, security testing standards, and building secure coding practices.

Qualifications

• Knowledge of OWASP Top 10 and API security in web/mobile apps.
• Experience with security testing tools and vulnerability analysis.
• Familiarity with secure SDLC, CI/CD, and risk-based remediation.

Responsibilities

• Plan and execute risk-based application security assessments across web, mobile, API.
• Validate pen testing results and perform remediation reviews.
• Coordinate with teams to discuss findings and monitor fixes.
• Provide evidence and closure documentation.

Skills

OWASP Top 10

OWASP API Top 10

Authentication

Authorization

Session security

Cryptography

Attack patterns

Education

Bachelor's degree in CS/InfoSec

Tools

Burp Suite

OWASP ZAP

Postman

Vulnerability scanners

Job description

We are one of the top 10 biggest banks in terms of assets in Indonesia and listed in the indonesia Stock Exchange, that offer banking products and services that help people and companies to succeed, creating wealth and growth through our Retail Banking, SME and Wholesale businesses.

Why Permata Bank ?

Here at Permata Bank, you will Learn, Grow, and Make A Difference,

You will have the appetite and the ability to learn many things, challenged to grow beyond ways you can imagine, and see the incredible difference you would have made along the journey.

This is our platform for you. We cannot promise a smooth ride, but rest assured, it is going to be a meaningful journey!

• Learn : We always think innovatively to improve the way we work, making it easier, better and faster.
• Grow : We provide excellent service to customers and encourage excellent performance in our daily work.
• Make a difference : We understand each other and together build strong relationships with internal and external parties based on mutual respect.

Job Description:

Application Security Assessment & Testing

• Plan and execute risk-based application security assessments for web, mobile, API, and supporting application components across new initiatives, major changes, and existing systems.
• Validate application penetration testing, vulnerability analysis, secure configuration reviews, and security testing result aligned with application criticality and release milestones.
• Review test evidence and validate reported findings for exploitability, business impact, severity, affected components, and false positives before communicating results.
• Coordinate with other teams to discuss findings through remediation, perform technical retesting, and document closure evidence, residual risks, and any agreed exceptions.

Developer Engagement & Technical Advisory

• Facilitate detailed technical discussions with application owners, developers, architects, QA, DevOps, and vendors to explain root causes, attack scenarios, and practical remediation options.
• Review source-code excerpts, application flows, API contracts, authentication and authorization logic, session handling, input validation, secrets management, and data protection controls as relevant to findings.
• Provide actionable secure-coding recommendations, compensating controls, and risk-based remediation priorities while considering application architecture and delivery constraints.
• Participate in design and change reviews to identify security requirements early and advise on secure implementation and acceptance criteria.

Secure SDLC & Assurance

• Support integration of SAST, DAST, SCA, API testing, and manual verification within the secure development lifecycle.
• Define and maintain application security testing standards, reporting templates, evidence requirements, and risk-based release security gates in coordination with relevant control owners.
• Analyze recurring vulnerabilities and root causes, communicate lessons learned, and recommend preventive improvements to engineering teams.
• Provide application security metrics, testing coverage, remediation aging, and risk status for management, audit, and governance reporting.

Required Skills:

• Application Security: Strong knowledge of OWASP Top 10, OWASP API Security Top 10, authentication/authorization, session security, basic cryptography, and common web/mobile/API attack patterns.
• Testing & Validation: Hands-on use of tools such as Burp Suite, OWASP ZAP, Postman, and vulnerability scanners; ability to reproduce findings safely and assess technical and business impact.
• Secure SDLC: Familiarity with CI/CD pipelines, SAST/DAST/SCA, dependency risk, threat modeling, and vulnerability lifecycle management.
• Communication: Strong technical writing, stakeholder facilitation, evidence documentation, prioritization, and cross-team collaboration.

Qualifications:

• Bachelor’s degree in Computer Science, Information Security, Software Engineering, or related discipline, or equivalent relevant experience.
• 4–7 years of relevant experience in application security, penetration testing, secure software engineering, or technical security assurance, including direct engagement with development teams.
• Experience in banking, financial services, fintech, or other regulated environments would be advantageous.

Preferred Skills & Certifications:

• Experience with mobile application testing, cloud-native applications, microservices, Kubernetes, DevSecOps automation, and threat modeling.
• Certifications such as OSWE, GWAPT, eWPT, CSSLP, OSCP, or equivalent practical application security credentials.

Directorates :

Technology

PT. Bank Permata Tbk hereby informs that the company does not impose any charges in the employee recruitment process.