Executive | Application Security Engineer

Macquarie Group; Indonesia; On-site; IDR 250,000,000 - 420,000,000; Full time

Job summary

Macquarie Group is recruiting an Executive | Application Security Engineer to strengthen secure software development lifecycle practices. You will identify security weaknesses via threat modelling and code reviews, and you will work with SAST, SCA, container and IaC security, API security, DAST, and RASP tools.

Applicants should have 4-6 years in application security, be familiar with GitHub Advanced Security, and have hands-on DevSecOps experience.

Qualifications

• 4-6 years of hands-on application security experience across the SDLC.
• Experience with threat modelling and secure code review.
• Knowledge of SAST, SCA, container and IaC security, API security, DAST, and RASP.
• Familiarity with programming languages such as Java, Python, or Go.
• Experience or interest in agentic engineering tools (e.g., Claude Code, GitHub Copilot).

Skills

4-6 years experience

Threat modelling

Secure code review

SAST

SCA

Container security

IaC security

API security

DAST

RASP

GitHub Advanced Security

Java

Python

Go

DevSecOps

CI/CD

Tools

GitHub Advanced Security

Job description

Executive | Application Security Engineer

• 4-6 years' experience in the application security domain with knowledge and hands on experience in securing applications throughout the software development lifecycle and identifying security weaknesses through threat modelling or secure code review.


• Familiarity with Static Application Security Testing (SAST), Software Composition Analysis (SCA), Container Security, Infrastructure as Code (IaC) Security, API Security, Dynamic Application Security Testing (DAST), and Runtime Application Self-Protection (RASP), particularly GitHub Advanced Security or other related tools.


• Experience in DevSecOps practices and tools, security engineering, infrastructure-as-code, CI/CD, automation, and application development desirable.


• Familiarity with at least one or more programming languages such as Java, Python, Go, or similar.


• Experience or strong interest in agentic engineering tools (e.g., Claude Code, GitHub Copilot), applied with disciplined validation and ownership.


• 4-6 years' experience in the application security domain with knowledge and hands on experience in securing applications throughout the software development lifecycle and identifying security weaknesses through threat modelling or secure code review.


• Familiarity with Static Application Security Testing (SAST), Software Composition Analysis (SCA), Container Security, Infrastructure as Code (IaC) Security, API Security, Dynamic Application Security Testing (DAST), and Runtime Application Self-Protection (RASP), particularly GitHub Advanced Security or other related tools.


• Experience in DevSecOps practices and tools, security engineering, infrastructure-as-code, CI/CD, automation, and application development desirable.


• Familiarity with at least one or more programming languages such as Java, Python, Go, or similar.


• Experience or strong interest in agentic engineering tools (e.g., Claude Code, GitHub Copilot), applied with disciplined validation and ownership.