Senior Security Engineer (AppSec / DevSecOps)

Jubelio; Jakarta Pusat; On-site; IDR 420,000,000 - 700,000,000; Full time

Benefits offered by this job

Medical Insurance

Bonus System

Paid Sick Days

Job summary

Jubelio is seeking a Senior Security Engineer to establish and run the security function as the first dedicated security engineer. You will lead threat modelling across apps, infra, and third-party integrations while owning risk scoring and the risk register to reflect business impact.

You will triage vulnerability findings, coordinate with DevOps and development squads, and drive security improvements, incident response, and compliance alignment across the platform.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, or related field, or equivalent experience.
• Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
• Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
• Able to read code and review pull requests for security issues in Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
• Experience handling real security incidents and writing post-incident reviews.
• Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
• Strong risk judgment prioritising by exploitability and business impact, not just CVSS scores.
• Certifications in OSCP, OSWE, CISSP are a plus, but demonstrated experience matters more.

Responsibilities

• Build and run Jubelio's security function as the first dedicated Security Engineer.
• Perform threat modelling across applications, infrastructure, repositories and integrations.
• Own security risk scoring and the risk register to reflect business impact.
• Triage and validate findings from scanners, SIEM, code scans; escalate only what matters.
• Analyze monthly security reports and translate into actions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation, post-incident improvements.
• Review code and architecture for security risks and coordinate fixes with developers.
• Define security standards and frameworks for secure development, secrets, access and vulnerability management.
• Decide areas needing penetration testing, scope with external vendors, verify fixes.
• Work with GRC to ensure controls and evidence meet compliance requirements.

Skills

Threat modelling

Code review (Go/NodeJS/TS)

Cloud & container security

Security incident handling

Vulnerability management

Education

Bachelor's degree in Computer Science or related field

Tools

Kubernetes

SAST/SCA tools

Vulnerability scanners

CI/CD security tooling

Code review tooling

Job description

Senior Security Engineer (AppSec / DevSecOps)

• Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.
• Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.
• Own security risk scoring and the risk register, so that severity reflects real business impact.
• Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escalation only what matters.
• Analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
• Review code and architecture for security risks, and work with developers to fix them.
• Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
• Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
• Work with GRC so that security controls and evidence meet compliance requirements.
• Coordinate with DevOps and development squads, who own remediation under our agreed SLA.

Requirements

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
• Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
• Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
• Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
• Experience handling real security incidents and writing post-incident reviews.
• Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
• Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.
• Experience scoping and managing penetration tests with external vendors is an advantage.
• Knowledge of compliance frameworks (ISO 27001, SOC 2, NIST Cybersecurity) is an advantage.
• Good communicator who can influence engineers without formal authority. Fluent in English and Bahasa Indonesia.
• Comfortable building from zero, with a strong sense of ownership. You will be the only security engineer at first.
• Certifications such as OSCP, OSWE, CKS or CISSP are a plus, but demonstrated experience matters more.

An Omnichannel Platform for retailers and wholesalers. Our mission is to simplify your business by integrating back office, warehouse, marketplace, webstore and point of sales (POS) into one dashboard.

Technology (Software Development)

Location

Company Size

Culture

• Energetic
• Here, we work together to make the dream work
• Fast-Paced
• Swift in handling new challenges and producing new ideas to improve
• Here, we work together to make the dream work
• Medical Insurance
• THR / Bonus system
• Paid Sick Days

Meet The Teams

Faisal has been working in various HR position and responsible for end-to-end HR area