Application Security Engineer: Secure SDLC & Pentesting

Stockbit; Daerah Khusus Ibukota Jakarta; On-site; IDR 240,000,000 - 480,000,000; Full time

Job summary

Stockbit is seeking an Application Security Engineer to embed security practices across product tribes, review code in Golang and JavaScript, and drive proactive security testing across web, mobile, and backend services.

You will model threat scenarios, coordinate external bug reports, and guide secure architectural decisions while staying current with evolving threats and defensive tooling.

Qualifications

• Strong understanding of web and mobile security fundamentals.
• Hands-on experience with penetration testing and secure code review.
• Familiarity with Golang and JavaScript (Stockbit’s main tech stack).
• Experience with static/dynamic analysis tools (Burp Suite, OWASP ZAP, Snyk, etc.).
• Ability to communicate complex security concepts in a clear, practical way to developers.
• Bonus: Exposure to CI/CD pipeline security, cloud security, or DevSecOps practices.

Responsibilities

• Embed with Product Tribes: Collaborate closely with engineers, QA, and product managers to ensure security considerations are part of every development stage (SDLC).
• Secure Code Review: Review application code (mainly Golang and JavaScript) to identify and mitigate vulnerabilities such as SQLi, XSS, CSRF, and IDOR.
• Security Testing: Conduct penetration testing, vulnerability scanning, and static/dynamic analysis to proactively uncover weaknesses across web, mobile, and backend services.
• Threat Modeling: Partner with teams to assess potential threats and design effective mitigations.
• Bug Bounty Management: Triage, validate, and coordinate resolution for bug reports submitted by external researchers.
• Security Architecture Guidance: Provide input on secure design patterns, ensuring security is built into architecture and deployments.
• Incident Response: Support investigation and remediation of application-related security incidents, minimizing impact and improving detection/prevention mechanisms.
• Security Awareness: Promote secure coding practices within the tribes through knowledge-sharing, internal training, and playbooks.
• Stay Current: Keep up with the latest vulnerabilities, frameworks, and attack vectors to continuously strengthen our defenses.

Skills

Penetration testing

Secure code review

Golang

JavaScript

Static analysis

Dynamic analysis

Tools

Burp Suite

OWASP ZAP

Snyk

Job description

Stockbit is seeking an Application Security Engineer to embed security practices across product tribes, review code in Golang and JavaScript, and drive proactive security testing across web, mobile, and backend services.

You will model threat scenarios, coordinate external bug reports, and guide secure architectural decisions while staying current with evolving threats and defensive tooling.