Senior Security Engineer (AppSec / DevSecOps)

Jubelio; Jakarta Selatan; On-site; IDR 260,000,000 - 480,000,000; Full time

Job summary

Jubelio is seeking a Security Engineer to establish and grow Jubelio's security function. You will model threats, triage vulnerabilities, and drive risk-based decisions across engineering, DevOps, and product teams.

You will work closely with GRC and external vendors to align security controls with ISO 27001, SOC 2, and NIST frameworks, while communicating in English and Bahasa Indonesia. This is a hands-on role with ownership from day one.

Qualifications

• Bachelor's degree or equivalent experience in a related field.
• Minimum 3 years in security engineering, AppSec, DevSecOps or similar.
• Able to read code and review pull requests for security issues in Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes.
• Experience handling security incidents and post-incident reviews.
• Experience with vulnerability management and security monitoring.
• Strong risk judgment prioritizing real exploitability and business impact.
• Knowledge of ISO27001, SOC 2, NIST is advantageous.
• Fluent in English and Bahasa Indonesia.

Responsibilities

• Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.
• Perform threat modelling across applications, infrastructure, repositories and third-party integrations, prioritising patches.
• Own security risk scoring and the risk register to reflect business impact.
• Triage and validate findings from scanners, SIEM alerts, code scanning and external reports.
• Analyze monthly security reports and translate into concrete decisions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
• Review code and architecture for security risks and coordinate fixes with developers.
• Define security standards and frameworks engineers can follow.
• Decide areas needing penetration testing and scope work with external vendors.
• Coordinate with GRC to meet compliance requirements.
• Collaborate with DevOps and development squads to ensure remediation under SLA.

Skills

Threat modelling

Code review for security

Cloud security (Kubernetes)

Incident response

Vulnerability management

SIEM/SAST/SCA tools

Risk prioritization

External pen tests management

Compliance knowledge (ISO 27001, SOC 2

English & Bahasa Indonesia

Education

Bachelor's degree in Computer Science, Information Security, Engineering, or related field

Tools

Kubernetes

SAST/SCA tools

Job description

Responsibilities

• Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.
• Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.
• Own security risk scoring and the risk register, so that severity reflects real business impact.
• Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escale only what matters.
• Analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
• Review code and architecture for security risks, and work with developers to fix them.
• Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
• Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
• Work with GRC so that security controls and evidence meet compliance requirements.
• Coordinate with DevOps and development squads, who own remediation under our agreed SLA.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
• Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
• Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
• Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
• Experience handling real security incidents and writing post-incident reviews.
• Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
• Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.
• Experience scoping and managing penetration tests with external vendors is an advantage.
• Knowledge of compliance frameworks (ISO 27001, SOC 2, NIST Cybersecurity) is an advantage.
• Good communicator who can influence engineers without formal authority. Fluent in English and Bahasa Indonesia.
• Comfortable building from zero, with a strong sense of ownership. You will be the only security engineer at first.
• Certifications such as OSCP, OSWE, CKS or CISSP are a plus, but demonstrated experience matters more.