Lead - VM & App Security Engineer

Starhub Ltd; Petaling Jaya; Sur place; MYR 120 000 - 180 000; Plein temps

Résumé du poste

Starhub Ltd in Petaling Jaya, Malaysia, seeks a Lead - Vulnerability Management (VM) & App Security Engineer to lead identification, assessment, prioritization, and remediation tracking across the tech environment.

You will work with application, infrastructure, cloud, and security teams to reduce cyber risk through a structured VM programme and robust app security practices.

Qualifications

• Degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience.
• Hands-on experience with vulnerability scanning tools (Tenable/Nessus and/or Qualys).
• Experience in vulnerability management, security operations, infrastructure security, or related cybersecurity function.
• Familiarity with OS, networks, cloud environments, and enterprise infrastructure.
• Understanding of OWASP Top 10 and vulnerability remediation practices.
• Experience with ticketing/workflow tools (Jira, ServiceNow).
• Ability to explain risk and remediation clearly to technical and non-technical stakeholders.
• Strong attention to detail and follow-through through closure.

Responsabilités

• Operate and maintain vulnerability scanning platforms (Tenable/Nessus, Qualys).
• Conduct authenticated and unauthenticated scans across servers, endpoints, networks, cloud workloads, and apps.
• Analyse results, validate findings, eliminate false positives, assess risk.
• Manage end-to-end vulnerability lifecycle: discovery, triage, remediation tracking, closure.
• Apply risk-based prioritisation using CVSS, asset criticality, and business impact.
• Collaborate with infra, app, cloud, and DevOps to define remediation plans.
• Produce vulnerability reports, dashboards, and management updates.
• Maintain vulnerability policies, scan schedules, and evidence for audits.

Connaissances

Vulnerability management

Security operations

Infrastructure security

Application security

Risk assessment

Communication to stakeholders

Formation

Degree in Cybersecurity/IT/CompSci

Outils

Tenable/Nessus

Qualys

Jira

ServiceNow

Fortify/SAST/DAST

CI/CD tools

Description du poste

Lead - VM & App Security Engineer

Location

Petaling Jaya, MY

Vulnerability Management Specialist

We are seeking a Vulnerability Management Specialist to lead the identification, assessment, prioritization, and remediation tracking of security vulnerabilities across our technology environment. This role will work closely with application, infrastructure, cloud, and security teams to reduce cyber risk through a structured, risk-based vulnerability management programme.

Key Responsibilities

• Operate and maintain vulnerability scanning platforms, preferably including Tenable/Nessus and Qualys.
• Conduct authenticated and unauthenticated vulnerability scans across servers, endpoints, network devices, cloud workloads, and applications.
• Analyse scan results, validate findings, eliminate false positives, and assess business and technical risk.
• Manage the end-to-end vulnerability lifecycle: discovery, triage, prioritisation, assignment, remediation tracking, validation, exception management, and closure.
• Apply risk-based prioritisation using CVSS, exploitability, asset criticality, internet exposure, business impact, and known active threats.
• Partner with infrastructure, application, cloud, and DevOps teams to define practical remediation plans and meet agreed remediation timelines.
• Produce regular vulnerability reports, dashboards, metrics, and management updates, including SLA compliance, overdue findings, vulnerability ageing, and risk trends.
• Maintain vulnerability management policies, procedures, asset coverage, scan schedules, and evidence for audit and compliance requirements.
• Support remediation of application and software-supply-chain vulnerabilities through tools and platforms such as JFrog, Bitbucket, SonarQube, Fortify, and CI/CD pipelines.
• Identify gaps in asset inventory, scanning coverage, and remediation ownership, and recommend process or automation improvements.
• Stay current on emerging vulnerabilities, exploit activity, vendor advisories, and threat intelligence relevant to the organisation.

Required Qualifications

• Degree in Cybersecurity, Information Technology, Computer Science, or equivalent practical experience.
• Experience in vulnerability management, security operations, infrastructure security, application security, or a related cybersecurity function.
• Hands-on experience with vulnerability scanning tools, especially Tenable/Nessus and/or Qualys.
• Strong understanding of vulnerability management processes, including scanning, validation, CVSS, risk assessment, remediation verification, exception handling, and reporting.
• Familiarity with common operating systems, networks, cloud environments, and enterprise infrastructure.
• Understanding of common application vulnerabilities and the OWASP Top 10.
• Experience working with ticketing and workflow tools such as Jira, ServiceNow, or equivalent.
• Ability to analyse technical findings and explain risk and remediation actions clearly to technical and non-technical stakeholders.
• Strong attention to detail, organisation, and follow-through in managing findings through closure.

Preferred Qualifications

• Experience with application-security or DevSecOps platforms such as JFrog, Bitbucket, SonarQube, Fortify, SAST, DAST, SCA, and container-security tools.
• Familiarity with cloud-security and cloud-native vulnerability management across AWS, Azure, or Google Cloud.
• Knowledge of threat intelligence sources, CISA Known Exploited Vulnerabilities, and exploitability assessment.
• Experience developing vulnerability dashboards, metrics, or automated reporting.
• Security certifications such as Security+, CEH, CISSP, CISM, CSSLP, or relevant vendor certifications.