Cloud Enterprise Application Security Architect

Perbadanan Insurans Deposit Malaysia; Kuala Lumpur; On-site; MYR 90,000 - 120,000; Full time

Job summary

A government agency in Malaysia seeks an experienced security professional to manage cloud security and application security. Candidates must possess a strong background in secure coding, compliance with security standards, and risk assessment strategies. The role requires a minimum of 5 years in the information security field, with emphasis on cloud environments. Ideal applicants will hold relevant degrees and certifications in cybersecurity.

Qualifications

• 5+ years in information security with hands-on experience in cloud environments.
• Expertise in cloud platforms like Azure and AWS.
• Strong coding skills in languages like .NET, Python, or JAVA.

Responsibilities

• Review and integrate secure design principles into applications.
• Manage security testing tools and collaborate with developers.
• Develop logging and monitoring strategies for threat detection.
• Ensure compliance with security standards like ISO27001.

Skills

Cloud Security Best Practices

Secure Coding Practices

Risk Assessment

Identity Access Management

DevSecOps Practices

Education

Bachelor's Degree in IT, Computer Science, Cybersecurity

Microsoft Azure Certifications

Tools

SonarQube

Burp Suite

Nexus Vulnerability Scanner

Job description

This role focuses on designing, implementing, and managing secure cloud, hybrid, and on-premises application systems. It supports security operations and development teams by embedding security throughout the application lifecycle, ensuring compliance with internal policies and ISMS ISO/IEC 27001 standards.

The job description outlines key responsibilities focused on ensuring the security of cloud applications throughout their lifecycle:

1.Secure Architecture and Design:

• Review and provide technical advice to business and development teams to integrate secure design principles, conduct risk assessment & propose mitigation plan into applications including, SaaS and PaaS platforms.
• Conduct knowledge sharing for IT and development teams on secure coding, cloud security practices, and emerging threats.

2.Operation of Application Security Management:

• Manage security testing tools like SAST (e.g., SonarQube) and DAST (e.g., Burp Suite, Nexus Vulnerability Scanner, etc.) to identify and collaborate with developers to fix security vulnerabilities.
• Review, design and implement the DevSecOps & CI/CD process.
• Implement and manage cloud security applications such as Microsoft Defender (Identity, Endpoint, Cloud), Purview, and Sentinel.

3.Risk Assessment and Mitigation:

• Assess risks for cloud-hosted applications, identify threats and vulnerabilities, implement mitigation strategies, and collaborate with the threat intelligence team to address emerging threats.
• Design logging and monitoring strategies for real-time threat detection and handle security incidents, including root cause analysis and remediation.

4.Compliance & Governance:

• Assist in ensuring the organisation meets security compliance and governance standards such as RMIT, ISO27001 AND NIST.

Education & Professional Experience

• Bachelor's Degree from a recognised university in Information Technology, Computer Science, Cybersecurity, or other relevant fields; and/or
• Microsoft Azure Administrator Associate, Azure Security Engineer and other relevant certifications.
• Strong knowledge and proficient on Identity Access Management such as Azure Entra
• Minimum of 5 years of working experience in information security.
• Minimum of 4 years of hands-on experience in security cloud environments.
• Strong knowledge of cloud security best practices and framework (Malaysia Public Sector Cloud Policy, NIST, ISO 27001, etc)
• Experience with cloud-native security services and Azure PaaS.

Technical Competencies

• Strong knowledge of cloud platforms (e.g. Azure, AWS, GCP) with experience in PaaS services and cloud-native application security.
• Proficient in secure coding practices, familiar with framework such as OWASP Top Ten, SANS SWE, etc.
• Hands-in experience with security tools such as SAST/DAST.
• Proficient in one or more programming language (e.g. .NET, Python, JAVA) with a strong understanding of security implications in code.
• Experience implementing DevSecOps practices, including integrating security controls within CI/CD pipelines.

This position is open to Malaysian citizens only.

By submitting your CV, you consent to the processing of your personal data in accordance with PIDM’s Privacy Notice which can be accessed at https://www.pidm.gov.my.