Senior AppSec & DevSecOps Engineer - Threat Modeling Lead

Jubelio; Jakarta Pusat; On-site; IDR 420,000,000 - 700,000,000; Full time

Benefits offered by this job

Medical Insurance

Bonus System

Paid Sick Days

Job summary

Jubelio is seeking a Senior Security Engineer to establish and run the security function as the first dedicated security engineer. You will lead threat modelling across apps, infra, and third-party integrations while owning risk scoring and the risk register to reflect business impact.

You will triage vulnerability findings, coordinate with DevOps and development squads, and drive security improvements, incident response, and compliance alignment across the platform.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, or related field, or equivalent experience.
• Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
• Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
• Able to read code and review pull requests for security issues in Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
• Experience handling real security incidents and writing post-incident reviews.
• Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
• Strong risk judgment prioritising by exploitability and business impact, not just CVSS scores.
• Certifications in OSCP, OSWE, CISSP are a plus, but demonstrated experience matters more.

Responsibilities

• Build and run Jubelio's security function as the first dedicated Security Engineer.
• Perform threat modelling across applications, infrastructure, repositories and integrations.
• Own security risk scoring and the risk register to reflect business impact.
• Triage and validate findings from scanners, SIEM, code scans; escalate only what matters.
• Analyze monthly security reports and translate into actions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation, post-incident improvements.
• Review code and architecture for security risks and coordinate fixes with developers.
• Define security standards and frameworks for secure development, secrets, access and vulnerability management.
• Decide areas needing penetration testing, scope with external vendors, verify fixes.
• Work with GRC to ensure controls and evidence meet compliance requirements.

Skills

Threat modelling

Code review (Go/NodeJS/TS)

Cloud & container security

Security incident handling

Vulnerability management

Education

Bachelor's degree in Computer Science or related field

Tools

Kubernetes

SAST/SCA tools

Vulnerability scanners

CI/CD security tooling

Code review tooling

Job description

Jubelio is seeking a Senior Security Engineer to establish and run the security function as the first dedicated security engineer. You will lead threat modelling across apps, infra, and third-party integrations while owning risk scoring and the risk register to reflect business impact.

You will triage vulnerability findings, coordinate with DevOps and development squads, and drive security improvements, incident response, and compliance alignment across the platform.