Lead Application Security Analyst

AIA Digital+; Kuala Lumpur; On-site; MYR 90,000 - 150,000; Full time

Job summary

AIA Digital+ is seeking an Application Security Analyst to support SG Tech with vulnerability analysis, validation, and remediation advisory for application security findings. You will review findings from SAST, SCA, and other tooling to determine genuine issues, false positives, or tool inaccuracies, and advise remediation.

You will collaborate with development teams to validate findings, explain risks, and support secure software delivery while staying current on OWASP CWE patterns and secure

Qualifications

• 3 years of experience in Application Security, Information Security, Secure Software Development, or related areas.
• Hands‑on experience with application security testing, vulnerability validation, secure code review, or vulnerability assessment.
• Experience working with SAST, SCA, or similar application security tools.
• Good understanding of OWASP Top 10, OWASP Web Security Testing Guide, CWE, and secure coding principles.
• Ability to analyze security findings and determine whether issues are exploitable, relevant, or false positives.

Responsibilities

• Analyze, triage, and validate application security findings generated by SAST, SCA, and other application security testing tools.
• Differentiate genuine vulnerabilities from false positives, informational findings, duplicate findings, and tool-generated inaccuracies.
• Review application source code to understand vulnerability context and identify potential security weaknesses.
• Assess exploitability, attack surface, attack path, and potential business impact of reported vulnerabilities.
• Provide risk-based remediation guidance to application teams.
• Work with development teams to explain security findings, clarify remediation actions, and support closure of identified issues.
• Document vulnerability analysis, triage decisions, risk ratings, business impact, and remediation recommendations.
• Track application security findings, remediation progress, recurring issues, and key application security metrics.
• Support secure software development practices by providing application security advisory to project and development teams.
• Stay updated on application security threats, common vulnerability patterns, secure coding practices, OWASP guidance, CWE weaknesses, and emerging attack techniques.

Skills

Application Security

Vulnerability Analysis

Secure Coding

Vulnerability Validation

SAST

SCA

OWASP Guidance

CWE weaknesses

Threat Modeling

Communication with Dev Teams

Education

Bachelor's degree in Computer Science / Information Security

Tools

Veracode

Checkmarx

SonarQube

Snyk

Nexus IQ

GitHub Advanced Security

Job description

AIA Digital+ is seeking an Application Security Analyst to support SG Tech with vulnerability analysis, validation, and remediation advisory for application security findings. You will review findings from SAST, SCA, and other tooling to determine genuine issues, false positives, or tool inaccuracies, and advise remediation.

You will collaborate with development teams to validate findings, explain risks, and support secure software delivery while staying current on OWASP CWE patterns and secure