Lead Application Security Engineer — Fintech Secure DevOps

Encora Inc.; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Job summary

Encora Inc. is seeking a seasoned security engineer to lead threat modeling for banking features and to architect security tooling across CI/CD pipelines. The role requires hands-on expertise in Java, Node.js, or Go, and a strong background in application security with software development experience.

You will mentor teams through secure coding practices, deliver reusable security patterns for cloud and AI deployments, and champion a Security Champion program across projects.

Qualifications

• 5+ years in Application Security with a background in Software Development.
• Proficiency in at least one core language: Java (Spring Boot), Node.js, or Go.
• Deep understanding of OWASP Top 10 and SANS Top 25.
• Experience with CI/CD integration (Jenkins, GitHub Actions).
• Bonus: Fintech or Banking familiarity.

Responsibilities

• Threat modeling: lead design reviews for new banking features and identify flaws before coding.
• Pipeline automation: architect and maintain SAST/DAST/SCA tooling in CI/CD to auto-block vulnerabilities.
• Code review: perform manual audits on high-risk components (Authentication, Ledger logic) in Java, Kotlin, or Swift.
• Cloud & AI patterns: deliver secure design templates for microservices and AI models.
• Culture: mentor developers through secure coding workshops and a Security Champion program.

Skills

Application Security

5+ years experience

Tools

Java (Spring Boot)

Node.js

Go

Jenkins

GitHub Actions

SonarQube

Snyk

GitLab CI

Job description

Encora Inc. is seeking a seasoned security engineer to lead threat modeling for banking features and to architect security tooling across CI/CD pipelines. The role requires hands-on expertise in Java, Node.js, or Go, and a strong background in application security with software development experience.

You will mentor teams through secure coding practices, deliver reusable security patterns for cloud and AI deployments, and champion a Security Champion program across projects.