Senior Application Security Lead

AIA Digital+ Malaysia

Kuala Lumpur

On-site

MYR 70,000 - 110,000

Full time

14 days+

Application generator

An application made for this job — a tailored resume and cover letter that speak straight to the posting.

Get past ATS filters

Job summary

AIA Digital+ Malaysia in Kuala Lumpur is seeking a Lead Analyst in Technology Centre (Security Analyst) to strengthen our application security capabilities. You will review findings from SAST and SCA, validate vulnerabilities, and advise remediation steps to secure software delivery.

Collaborate with development teams, explain risks, and document analyses, risk ratings, and remediation plans. A strong background in OWASP top 10, secure coding, and hands-on tool experience (Veracode, Checkmarx,

Qualifications

3 years of experience in Application Security, Information Security, Secure Software Development, or related areas.
Hands-on experience with application security testing, vulnerability validation, secure code review, or vulnerability assessment.
Experience working with SAST, SCA, or similar tools.
Good understanding of OWASP Top 10, OWASP Web Security Testing Guide, CWE, and secure coding principles.
Ability to analyze security findings and determine exploitability and relevance.
Knowledge of common web app security issues such as injection, broken access control, insecure authentication, insecure deserialization, cryptographic weaknesses, and insecure configuration.
Familiarity with API security testing and secure SDLC, DevSecOps, CI/CD pipelines.
Experience with application security tools such as Veracode, Checkmarx, SonarQube, Snyk, Nexus IQ, GitHub Advanced Security.

Responsibilities

Analyze, triage, and validate application security findings generated by SAST, SCA, and other testing tools.
Differentiate genuine vulnerabilities from false positives, informational findings, or duplicates.
Review application source code to understand vulnerability context and identify weaknesses.
Assess exploitability, attack surface, attack path, and business impact of reported vulnerabilities.
Provide risk-based remediation guidance to application teams.
Explain findings to development teams and support remediation closure.
Document vulnerability analysis, triage decisions, risk ratings, business impact, and remediation recommendations.
Track findings, remediation progress, recurring issues, and key application security metrics.
Stay updated on threats, OWASP guidance, CWE weaknesses, and emerging attack techniques.