Cybersecurity Lead (Cloud)

Neutron Pte. Ltd.; Kuala Lumpur; On-site; MYR 240,000 - 380,000; Full time

Job summary

Neutron seeks an experienced information security leader in Kuala Lumpur to ensure a confidential business platform is secure by design. You will demonstrate security to a client with high standards and govern secure practices across delivery.

You will own security across the lifecycle, lead threat modelling and architecture reviews for an AWS-based platform, and coordinate VAPT, encryption, logging and incident response for go-live.

Qualifications

• 10+ years in information security and at least 5 years in app/cloud security.
• Hands-on AWS security experience (IAM, KMS, WAF, GuardDuty, etc.).
• Strong knowledge of OWASP Top 10 and ASVS, threat modelling and secure coding.
• Experience leading VAPT cycles and remediation with dev teams.
• Familiar with ISO 27001 / NIST CSF and audit support.
• Professional certifications such as CISSP, CCSP, CISM or AWS Security.

Responsibilities

• Own application and solution security across the delivery lifecycle from design to go-live.
• Lead threat modelling and security architecture reviews for the cloud-native platform on AWS.
• Define and enforce secure development practices (SSDLC) incl. code reviews, SAST/DAST.
• Specify identity access controls: MFA, SSO, RBAC and privileged access.
• Define encryption, key management, secrets handling, logging and monitoring.
• Coordinate vulnerability assessment and penetration testing (VAPT) and remediation.
• Map controls to client security standards and assist audits.
• Collaborate with cloud and DevOps teams on infrastructure security and incident response.

Skills

Information security

AWS security

Threat modelling

Secure coding

VAPT

Audits & compliance

ISO 27001 / NIST CSF

Security certifications

PDPA knowledge

Job description

Neutron is a Singapore technology company that builds and runs mission-critical digital platforms for government, regulated industries and large enterprises. We are building a delivery team in Kuala Lumpur for a large-scale platform modernisation programme.

The programme replaces a long-running legacy system with a cloud-native platform on AWS, with configurable workflows, a new user experience and integration with external systems. It is a multi-year engagement covering delivery and post-go-live support.

These roles are full-time, based in Kuala Lumpur and on-site with the client. The start date is subject to project confirmation.

About the role

You will make sure a business-critical platform handling confidential information is secure by design, and demonstrate it to a client with high security and compliance standards.

Key responsibilities

Own application and solution security across the delivery lifecycle, from design through go-live.

Lead threat modelling and security architecture reviews for the cloud-native platform on AWS.

Define and enforce secure development practices (SSDLC), including code review standards, SAST, DAST and dependency scanning in CI/CD.

Specify identity and access controls: MFA, SSO, role-based access, privileged access and session management.

Define encryption, key management, secrets handling, logging, audit trail and security monitoring requirements.

Coordinate vulnerability assessment and penetration testing (VAPT), track remediation and sign off security readiness.

Map controls to client security standards and applicable regulatory requirements, and prepare evidence for audits.

Work with the cloud and DevOps team on infrastructure security, and lead security incident response planning for go-live.

Mentor a security analyst and raise security awareness across the development team.

About you

10+ years in information security, with at least 5 years in application or cloud security on enterprise systems.

Hands-on AWS security experience (IAM, KMS, WAF, GuardDuty, Security Hub or equivalent).

Strong knowledge of OWASP Top 10 and ASVS, threat modelling and secure coding for Java web applications.

Experience leading VAPT cycles and remediation with development teams.

Experience aligning systems with security frameworks (e.g. ISO 27001, NIST CSF) and supporting audits.

Professional certification such as CISSP, CCSP, CISM or AWS Certified Security - Specialty.

Security work in financial services, regulated industries or government.

Knowledge of Malaysian technology risk and data protection requirements (e.g. PDPA).

OSCP or other offensive security certification.