Principal Digital Security Architect

Encora Inc.; Kampung Malaysia Tambahan; On-site; MYR 180,000 - 300,000; Full time

Job summary

Encora Inc. is seeking a Senior Security Architect for Banking/Fintech in Malaysia. You will lead API security design, CIAM strategy, and secure development practices, ensuring cryptographic trust and compliant data protection.

Responsibilities include defining patterns for authentication, authorization, MFA, and secure integrations with partners, as well as threat modeling and SDLC governance to prevent critical flaws before coding begins.

Qualifications

• 8+ Years Experience: mix of software engineering and security architecture.
• Ex-Developer: able to read code (Java, Kotlin, React or Node.js).
• Banking/Fintech experience: preference for secured payment gateways, ledgers or wallets.

Responsibilities

• API & Ecosystem Architecture.
• Secure API Gateway: policies for rate limiting, throttling, and authorization.
• Supply Chain Security: secure integration patterns with 3rd party partners.
• Microservices Mesh: move to cryptographic trust with mTLS and service-to-service authentication.
• Identity & Access Management (CIAM) and Identity Strategy for BI, MFA, and Step-Up authentication.
• Token Lifecycle: standards for OAuth 2.0 and OIDC; comply with FAPI.
• Secure Development Lifecycle (SDLC) and Threat Modeling sessions.
• Paved Roads: secure-by-default libraries and encryption wrappers.
• Data Privacy & Cryptography: field-level encryption and right-to-be-forgotten support.
• Privacy Engineering: support GDPR/CCPA without breaking ledger immutability.

Skills

API Security

REST & GraphQL

OAuth 2.0 / OIDC

JWT / JWKS

Mobile Security

CIAM

Threat Modeling

Secure SDLC

Java/Kotlin/React/Node.js

Job description

Key Responsibilities

• API & Ecosystem Architecture
• The API Fortress: Architect the security layer for our API Gateway (e.g., Kong, Apigee, AWS Gateway). Define global policies for Rate Limiting, Throttling, and Authorization (preventing BOLA/IDOR attacks).
• Supply Chain Security: Design secure integration patterns for our 3rd party partners (Fintechs, Credit Bureaus, Payment Processors). Ensure their insecurities do not become our breaches.
• Microservices Mesh: Define how our internal services trust each other. Move from "Network Trust" to "Cryptographic Trust" using mTLS and Service-to-Service authentication.
• Identity & Access Management (CIAM)
• Identity Strategy: Own the architecture for Customer Identity (CIAM). Design flows for Biometric Binding, Adaptive MFA, and Step-Up Authentication for high-value transactions.
• Token Lifecycle: Define the standards for OAuth 2.0 and OpenID Connect (OIDC). Ensure we are using Financial-grade API (FAPI) standards for token issuance, revocation, and storage.
• Secure Development Lifecycle (SDLC)
• Threat Modeling: Lead "Whiteboard Hacking" sessions with product owners. Identify business logic flaws (e.g., race conditions in ledgers, bypassable KYC steps) before a single line of code is written.
• Paved Roads: Work with DevOps to architect secure-by-default libraries. (Example: Create a standard "Encryption Wrapper" library that all developers must use, so they don't invent their own crypto).
• Data Privacy & Cryptography
• Data Defense: Define the architecture for Field-Level Encryption (FLE) in the database for PII and Banking Secrets.
• Privacy Engineering: Architect systems that support "Right to be Forgotten" (GDPR/CCPA) without breaking the immutability of the financial ledger.

Strategic Deliverables

• Identity Patterns: Deliver new security design patterns and components for authentication, authorization, SSO, MFA, and Partner security to ensure seamless and secure user access.
• Mobile & Edge: Deliver new security design patterns and components for Mobile security, ensuring consistency between iOS, Android, and the backend.
• Modern Tech Stack: Deliver API, container, cloud, and AI security design patterns to support the bank's move toward intelligent, cloud-native infrastructure.

What We Are Looking For

The Background

• 8+ Years Experience: A mix of Software Engineering and Security Architecture.
• Ex-Developer: You must be able to read code (Java, Kotlin, React or Node.js, ).
• Banking/Fintech Experience: Strong preference for candidates who have secured payment gateways, ledgers, or wallets.

The Technical Skills

• API Security: Deep mastery of REST and GraphQL security.
• Auth Protocols: You can draw the OAuth 2.0 Authorization Code Flow with PKCE from memory. You understand JWT signing and JWKS key rotation.
• Mobile Security: Understanding of how mobile apps store secrets (KeyStore/Keychain) and how to prevent API abuse from emulators/bots.

The Mindset

• Business Aligned: You understand that a bank exists to process transactions. You design security that reduces risk without destroying the User Experience (UX).
• Pragmatic: You know when to demand a "Blocker" fix and when to accept a "Risk Acceptance" waiver.