DevSecOps Engineer App & Endpoint Security | Flexible Hours

Respond; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Benefits offered by this job

Culture and growth

Competitive pay

Mental health allowance

Flexible hours

Virtual events

Job summary

Respond.io is hiring a DevSecOps Engineer (Application & Endpoint Security) to own the security layer around code delivery, cloud telemetry, and developer endpoints. You’ll write code, tune tools, build detections, and respond to incidents, collaborating with the GRC function for audits.

The position emphasizes hands‑on engineering, AI‑assisted security, and secure SDLC practices to enable fast, safe software delivery while mitigating risk.

Qualifications

• 3+ years in Application Security or DevSecOps with OWASP basics.
• Ability to read production code in Node.js/JavaScript and trace flaws.
• Hands-on SCA/SAST, deploying tools with risk prioritization.
• CI/CD hardening, secret scanning, and SSO/token governance.
• Experience with AWS security telemetry and incident response.
• Proven security automation in Python, TypeScript, or Bash.
• English communication with engineering teams.

Responsibilities

• Own dependency and container security across Node.js ecosystems in CI/CD.
• Tune AI-assisted SAST and run annual third‑party pentests end-to-end.
• Harden GitHub Actions workflows, secret scanning, and OIDC usage.
• Build and operate a centralized SIEM with multiple data sources.
• Triage endpoint security signals and coordinate incident response.
• Drive continuous security improvements across tooling and processes.

Skills

AppSec

Node.js

SCA

SAST

CI/CD

AWS Security

MDM/EDR

Pentest Coordination

Security Automation

English

Tools

Socket.dev

Semgrep

Trivy

TruffleHog

GitHub Actions

OIDC

CloudTrail

GuardDuty

Job description

Respond.io is hiring a DevSecOps Engineer (Application & Endpoint Security) to own the security layer around code delivery, cloud telemetry, and developer endpoints. You’ll write code, tune tools, build detections, and respond to incidents, collaborating with the GRC function for audits.

The position emphasizes hands‑on engineering, AI‑assisted security, and secure SDLC practices to enable fast, safe software delivery while mitigating risk.