Application Security Engineer — Flexible Hours, AI‑Driven Sec

Respond.io; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Benefits offered by this job

Mental health allowance

Flexible working hours

Competitive compensation

Virtual events

Job summary

respond.io is hiring an Application Security Engineer to own two core problems: securing the code we write and the code we depend on. You will threat model features, tune SAST pipelines, and secure CI/CD pipelines across Node.js and cloud environments. This hands-on role builds guardrails to prevent vulnerabilities and responds to security incidents.

You’ll work on security tooling, vulnerability management, and collaboration with engineers to reduce risk while supporting rapid product delivery.

Qualifications

• 3+ years in an application security role with Node.js/JavaScript root-cause analysis.
• Secured software supply chains using dependency/license/container scanning tools with CI/CD policy enforcement.
• Threat modeling on new features and coordinating pentests from scoping to remediation.
• Hardened CI/CD and GitHub orgs with branch protection, secret scanning, and Actions security.
• Experience with AWS security services (GuardDuty, Inspector, Detective) and edge protections (WAF).
• Built security tools or CI plugins in Python, TypeScript, or Bash; AI-based automations a plus.
• Ability to explain risks clearly to engineers and stakeholders.

Responsibilities

• Own software supply-chain security across our Node.js ecosystem with dependency/license scanning.
• Run end-to-end application security testing, threat modeling, and secure code practices.
• Secure GitHub orgs and AWS infrastructure; enforce secure CI/CD workflows and IAM best practices.
• Triager security signals and improve detection capabilities across endpoints.
• Own edge protection: tune WAF rules and network firewall policies against threats.
• Act as primary security responder for incidents and drive tooling improvements.

Skills

Node.js/JS security

Threat modeling

CI/CD security

GitHub security

AWS security

Security tooling

Scripting languages

Tools

Socket.dev

Dependabot

Trivy

Semgrep

AWS GuardDuty

Inspector

Detective

Job description

respond.io is hiring an Application Security Engineer to own two core problems: securing the code we write and the code we depend on. You will threat model features, tune SAST pipelines, and secure CI/CD pipelines across Node.js and cloud environments. This hands-on role builds guardrails to prevent vulnerabilities and responds to security incidents.

You’ll work on security tooling, vulnerability management, and collaboration with engineers to reduce risk while supporting rapid product delivery.