Manager | Application Security Engineer

Macquarie Group; Indonesia; On-site; IDR 350,000,000 - 550,000,000; Full time

Job summary

Macquarie Group seeks an experienced security engineer to lead application security across the software development lifecycle in Indonesia. You will assess risks, perform threat modelling, and conduct secure code reviews.

The role requires hands-on expertise with SAST, SCA, container and IaC security, API security, DAST, and RASP, plus practical DevSecOps, CI/CD, and automation experience.

Qualifications

• 8+ years in application security spanning SDLC and threat modelling/secure code review.
• Familiar with SAST, SCA, container security, IaC security, API security, DAST, and RASP.
• Experience with DevSecOps, CI/CD, automation, and secure software development.

Skills

Application security

Threat modelling

Secure code review

SAST

SCA

Container security

IaC security

API security

DAST

RASP

GitHub Advanced Security

DevSecOps

CI/CD

Automation

Java

Python

Go

Claude Code

GitHub Copilot

Tools

GitHub Copilot

Job description

• 8+ years' experience in the application security domain with knowledge and hands on experience in securing applications throughout the software development lifecycle and identifying security weaknesses through threat modelling or secure code review.
• Familiarity with Static Application Security Testing (SAST), Software Composition Analysis (SCA), Container Security, Infrastructure as Code (IaC) Security, API Security, Dynamic Application Security Testing (DAST), and Runtime Application Self-Protection (RASP), particularly GitHub Advanced Security or other related tools.
• Experience in DevSecOps practices and tools, security engineering, infrastructure-as-code, CI/CD, automation, and application development desirable.
• Familiarity with at least one or more programming languages such as Java, Python, Go, or similar.
• Experience or strong interest in agentic engineering tools (e.g., Claude Code, GitHub Copilot), applied with disciplined validation and ownership.
• 8+ years' experience in the application security domain with knowledge and hands on experience in securing applications throughout the software development lifecycle and identifying security weaknesses through threat modelling or secure code review.
• Familiarity with Static Application Security Testing (SAST), Software Composition Analysis (SCA), Container Security, Infrastructure as Code (IaC) Security, API Security, Dynamic Application Security Testing (DAST), and Runtime Application Self-Protection (RASP), particularly GitHub Advanced Security or other related tools.
• Experience in DevSecOps practices and tools, security engineering, infrastructure-as-code, CI/CD, automation, and application development desirable.
• Familiarity with at least one or more programming languages such as Java, Python, Go, or similar.
• Experience or strong interest in agentic engineering tools (e.g., Claude Code, GitHub Copilot), applied with disciplined validation and ownership.