Application Security Engineer (Stockbit)

Bibit.id; Daerah Khusus Ibukota Jakarta; On-site; IDR 223,200,000 - 334,800,000; Full time

Job summary

Bibit.id is seeking an Application Security Engineer to enhance the security of applications across mobile and backend systems. The ideal candidate will embed with product teams, conduct thorough security reviews, and lead initiatives to promote security awareness. Responsibilities include identifying vulnerabilities through code reviews and testing, alongside collaborating with developers to integrate security into the development lifecycle. Strong knowledge of web and mobile security fundamentals and experience with penetration testing are essential for this role.

Qualifications

• Strong understanding of web and mobile security fundamentals.
• Hands-on experience with penetration testing and secure code review.
• Familiarity with Golang and JavaScript.

Responsibilities

• Collaborate closely with engineers, QA, and product managers to ensure security considerations are part of every development stage.
• Review application code to identify and mitigate vulnerabilities.
• Conduct penetration testing, vulnerability scanning, and static/dynamic analysis.
• Partner with teams to assess potential threats and design mitigations.
• Manage bug bounty reports submitted by external researchers.
• Provide guidance on secure design patterns.
• Support investigation and remediation of application-related security incidents.
• Promote secure coding practices through knowledge-sharing.
• Stay updated on latest vulnerabilities and attack vectors.

Skills

Web and mobile security fundamentals

Penetration testing

Secure code review

Communication of security concepts

Tools

Burp Suite

OWASP ZAP

Snyk

Job description

At Stockbit & Bibit, we prioritize the security of our applications and the data of our users. As an Application Security Engineer, you’ll play a key role in ensuring the security and integrity of our products from mobile apps to backend systems by working closely with our product and engineering tribes.

You’ll be directly involved in embedding security practices into our SDLC, partnering with each tribe to identify potential risks early, and helping teams design and build securely by default.

Why Join Us?

You’ll be part of a growing security culture that believes in collaboration over gatekeeping — working directly with engineers and product teams to make security a shared responsibility. You’ll also have the opportunity to shape how AppSec operates across multiple tribes and influence security strategy at scale.

What You’ll Do

• Embed with Product Tribes: Collaborate closely with engineers, QA, and product managers to ensure security considerations are part of every development stage (SDLC).
• Secure Code Review: Review application code (mainly Golang and JavaScript) to identify and mitigate vulnerabilities such as SQLi, XSS, CSRF, and IDOR.
• Security Testing: Conduct penetration testing, vulnerability scanning, and static/dynamic analysis to proactively uncover weaknesses across web, mobile, and backend services.
• Threat Modeling: Partner with teams to assess potential threats and design effective mitigations.
• Bug Bounty Management: Triage, validate, and coordinate resolution for bug reports submitted by external researchers.
• Security Architecture Guidance: Provide input on secure design patterns, ensuring security is built into architecture and deployments.
• Incident Response: Support investigation and remediation of application-related security incidents, minimizing impact and improving detection/prevention mechanisms.
• Security Awareness: Promote secure coding practices within the tribes through knowledge-sharing, internal training, and playbooks.
• Stay Current: Keep up with the latest vulnerabilities, frameworks, and attack vectors to continuously strengthen our defenses.

What We’re Looking For

• Strong understanding of web and mobile security fundamentals.
• Hands‑on experience with penetration testing and secure code review.
• Familiarity with Golang and JavaScript (Stockbit’s main tech stack).
• Experience with static/dynamic analysis tools (e.g., Burp Suite, OWASP ZAP, Snyk, etc.).
• Ability to communicate complex security concepts in a clear, practical way to developers.
• Bonus: Exposure to CI/CD pipeline security, cloud security (AWS/GCP), or DevSecOps practices.