Security Assurance Lead

Confidential; Petaling Jaya; On-site; MYR 180,000 - 260,000; Full time

Job summary

Confidential is seeking an experienced security architect with hands-on expertise in secure design, cryptography, and API/mobile/web security. You will lead architectural reviews, threat modelling, and advanced testing across cloud and on-prem environments.

You will develop innovative security controls, socialise hardening standards, and drive risk-compliant security programs while collaborating with Engineering on purple-team exercises and AI security initiatives.

Qualifications

• Must have hands-on secure architecture design and development experience.
• Strong coding background and fluency in multiple modern languages.
• Solid understanding of cryptography and encryption standards.
• At least 8 years in security with 4+ of the listed areas.

Responsibilities

• Perform secure architecture review, threat modelling, vulnerability assessment, and penetration testing.
• Develop/evaluate security controls to strengthen mobile app security and fraud detection.
• Produce threat landscape reports on evolving tech such as PQC and autonomous AI agents.
• Develop and socialise security/hardening standards to reduce attack surface.
• Develop/evaluate AI security testing processes and autonomous pentesting tools.
• Verify compliance of infrastructure and apps against security standards.
• Create dashboards to track non-compliance and report to Risk Committee; engage 1LoD/2LoD stakeholders.
• Lead purple-teaming engagements with Engineering from scoping to remediation.

Skills

Strong coding background

Secure design & coding practices

Cryptographic algorithms & encryption

Experience with fintech security

Design & implementation of cloud-based

Agentic AI security solutions

RESTful APIs, web/mobile security

Tools

Container-based infrastructures in the cloud

Job description

You should possess an extensive hands-on experience in solutions design and development and a deep understanding of web and mobile application security, API security, container security, data protection, AI security, cryptography, networking security, operating system security.

• Perform secure architecture review, threat modelling, vulnerability assessment, and penetration testing.
• Develop and/or evaluate innovative security controls to strengthen mobile application security such as facial recognition, cognitive breaks, transaction monitoring and fraud detection measures.
• Develop periodic threat landscape reports for evolving technologies, such as post quantum cryptography (PQC) and autonomous AI agents, for technical and executive audiences, and make practical recommendations for sustained security improvements.
• Develop and socialise security and hardening standards to reduce attack surface and likelihood of vulnerability exploitation.
• Develop and/or evaluate processes or agentic AI solutions to conduct security testing such as coding assistant tools or autonomous AI pentesting.
• Verify compliance of underpinning infrastructure and applications based on defined security and hardening standards.
• Develop a dashboard to track non-compliance with organisation technical standards for reporting into the Risk Committee. Proactively engage relevant 1LoD and 2LoD stakeholders to minimize regulatory and risk appetite breaches.
• Lead engagements with Engineering teams in purple teaming exercise from scoping through remediation and provide technical guidance.

The must haves:

• Strong background in coding, fluent in several modern programming languages.
• Excellent understanding of secure design and coding best practices.
• Familiarity with market-leading cryptographic algorithms and encryption standards.
• At least 8 years experience with a minimum of 4 of the following:

• o Experience with highly-available and highly-secure solutions in financial/fintech sector;
• o Design and implementation experience of container-based infrastructures in the cloud;
• o Design and implementation experience of agentic AI solutions;
• o Development and coding experience of mobile applications, RESTful APIs, web applications; and
• o Secure code review and/or pentesting experience of mobile applications, RESTful APIs, web applications.
• Experience developing or using vulnerability scanning tools for mobile, API and web application security testing.

Any 2 of the following certifications would be a plus:

• Certifications from AWS, Azure or GCP related to solutions architecture, development or security
• Cybersecurity certifications, such as OSWE, CCSLP, GWEB
• Pen-testing accreditation such as CREST or CBEST.
• Professional IT security certifications such as CISSP, CISM and CISA.