Security Engineer - Vulnerability & Exposure Management

Roche; Petaling Jaya; On-site; MYR 70,000 - 100,000; Full time

Job summary

Roche is looking for a Security Engineer to join their Global Security Monitoring & Incident Response team in Petaling Jaya, Malaysia. This role is crucial for identifying and mitigating cybersecurity risks across the organization.

The ideal candidate will have an Associate Degree or 5+ years of relevant experience, with a strong understanding of security concepts and hands-on scripting skills. You will triage vulnerabilities and collaborate with various teams to enhance Roche’s security posture.

A passion for cybersecurity and continuous learning is essential, along with industry certifications viewed as strong assets.

Qualifications

• Experience triaging, analyzing, and escalating security vulnerabilities.
• Strong understanding of web application, network, endpoint, and cloud security.
• Hands-on scripting or programming experience with Python or JavaScript.

Responsibilities

• Triage, investigate, and respond to critical vulnerabilities.
• Evaluate and prioritize vulnerabilities from security tools and bug bounty initiatives.
• Collaborate with teams to drive remediation activities.

Skills

Cybersecurity foundation

Analytical thinking

Technical curiosity

Communication of technical risks

Scripting experience (Python, JavaScript, Node.js)

Education

Associate Degree in relevant field or 5+ years in information security

Tools

Vulnerability scanning tools

Automation tools

Job description

The Position

The Global Security Monitoring & Incident Response (MIR) team at Roche is dedicated to protecting our networks, systems, applications, and users from constantly evolving cyber threats. As a Security Engineer within the Vulnerability & Exposure Management team, you will play a critical role in identifying, assessing, prioritizing, and reducing cybersecurity risks across Roche’s global environment.

This role goes beyond reviewing scanner outputs. You will help investigate critical vulnerabilities, assess exploitability, improve security tooling and automation capabilities, and partner with stakeholders globally to strengthen Roche’s security posture.

You will join a collaborative and highly technical cybersecurity team that values innovation, curiosity, continuous learning, and proactive risk reduction.

Your Opportunity

• Triage, investigate, and respond to critical vulnerabilities impacting Roche systems and applications
• Evaluate and prioritize vulnerabilities identified through security tools and external programs, including bug bounty initiatives
• Research emerging threats and assess exploitability against Roche’s attack surface
• Collaborate with infrastructure, cloud, application, and security teams to drive remediation activities
• Assess company systems and web applications using automated and manual testing approaches
• Engineer and enhance vulnerability scanning, detection, automation, and monitoring capabilities
• Contribute to security monitoring and incident response activities within a global environment
• Develop scripts, detection logic, templates, and automation workflows to improve operational efficiency
• Support continuous improvement initiatives across vulnerability and exposure management processes

Who you are

You bring a strong cybersecurity foundation combined with analytical thinking, technical curiosity, and a proactive approach to solving complex security challenges.

• Associate Degree in a relevant field or 5+ years of professional experience in information security, with demonstrated experience triaging, analyzing, and escalating security vulnerabilities
• Strong understanding of web application, network, endpoint, and cloud security concepts, including vulnerability management or attack surface management within complex enterprise environments
• Hands‑on scripting or programming experience using languages such as Python, JavaScript, or Node.js, with familiarity in security tooling, detection logic, automation, or custom scripting
• Experience validating vulnerabilities, assessing exploitability, and supporting security monitoring or incident response activities
• Ability to communicate technical risks effectively to both technical and non-technical stakeholders, while balancing operational priorities and research initiatives
• Passion for cybersecurity, continuous learning, and emerging security trends, with exposure to open-source security projects or modern AI‑assisted engineering workflows considered advantageous
• Professional fluency in English, with industry certifications related to offensive or application security (e.g., OSCP, GWAPT, OSWE) and enterprise cloud security experience viewed as strong assets

Roche is an Equal Opportunity Employer.