Senior Application Security Specialist – AppSec / DevSecOps

Randstad Malaysia; Kuala Lumpur; On-site; MYR 120,000 - 210,000; Full time

Job summary

Randstad Malaysia is seeking a Senior Application Security Specialist to strengthen security across the Software Development Lifecycle, DevSecOps and architecture. The role is hands-on, partnering with software engineering, Agile and DevOps teams to build secure applications and services.

You will embed Secure by Design and Shift‑Left practices, perform threat modelling, risk assessments and security reviews, and guide security controls across cloud-native environments.

Qualifications

• Hands-on Application Security and DevSecOps experience in a security-driven environment.
• Experience performing threat modelling, risk assessments and security reviews.
• Knowledge of secure SDLC practices and modern security controls across cloud-native architectures.

Responsibilities

• Partner with Agile, DevOps and security teams to embed security in design and development.
• Conduct security reviews and architecture assessments to identify weaknesses and remediation.
• Perform threat modelling, risk analyses and security risk assessments.
• Define and communicate security requirements aligned to policy and architecture.
• Provide guidance across the SDLC for secure design, coding and testing.
• Promote Secure by Design and Shift‑Left practices in CI/CD pipelines.
• Assess cloud-native security including container and API security controls.
• Research emerging threats and advise on mitigations.
• Develop and improve security standards, processes and automation.
• Coach engineers and stakeholders on secure development and security culture.

Skills

application security

Product Security

Security Architecture

Threat Modelling

Risk Assessment

Secure SDLC

DevSecOps

Security-by-Design

Shift-Left Security

OWASP Top 10

SAST

DAST

SCA

API Security

API Testing

Container Security

Cloud Security

CI/CD Security

Vulnerability Management

Education

Bachelor Degree

Tools

AWS

Azure

GCP

Kubernetes

Docker

Job description

about the company

Our client is a global financial technology and financial messaging organisation supporting critical financial services and institutions worldwide. The organisation operates within a highly regulated, security-critical technology environment where cybersecurity, application security, resilience and secure software development are fundamental to business operations.

With continued investment in cloud-native technologies, APIs, microservices, containers and DevSecOps, the organisation is strengthening its Application Security capability to ensure security is embedded throughout the software development lifecycle.

You will join an international and diverse technology security environment, working alongside experienced cybersecurity, engineering, architecture and technology professionals across global teams.
about the job

We are looking for a Senior Application Security Specialist to strengthen the organisation's Application Security, Product Security and Security Architecture capabilities.

This is a hands‑on Application Security / DevSecOps / Security Architecture role where you will act as a trusted security partner to software engineering, Agile, DevOps and DevSecOps teams, helping them build and operate secure applications and services.

You will be responsible for embedding security‑by‑design and shift‑left security practices throughout the Software Development Lifecycle (SDLC), from architecture and design through development, testing, deployment and operations.

Key responsibilities include:

• Partner with Agile, Software Engineering, DevOps and DevSecOps teams to integrate security into application design and development.
• Conduct Application Security and Security Architecture reviews, identifying security weaknesses and recommending practical remediation.
• Perform Threat Modelling, Risk Analysis and Security Risk Assessments to identify threats, vulnerabilities, business impact and appropriate security controls.
• Define and communicate security requirements based on business requirements, technology architecture, security policies, threats and risk appetite.
• Provide security guidance across the Software Development Lifecycle (SDLC), including secure design, secure coding, security testing, deployment and operations.
• Establish and promote Secure by Design, Shift‑Left Security and DevSecOps practices.
• Support the integration and adoption of SAST, DAST, SCA, API Security Testing and Container Security within CI/CD pipelines.
• Assess application and API security risks across cloud‑native, microservices, containerised and orchestrated environments.
• Research emerging cybersecurity threats, vulnerabilities and security alerts, assessing their potential impact and recommending remediation.
• Develop and improve security standards, guidelines, processes and security automation capabilities.
• Identify opportunities to improve security testing, security automation and software delivery processes.
• Work closely with engineering and technology teams to strengthen application security controls without compromising delivery velocity.
• Promote a strong security culture across technology and engineering teams.
• Coach and share Application Security and secure development knowledge with colleagues and technical stakeholders.

Key Technical Skills

Candidates with experience in the following areas will be highly relevant:

Application Security | Product Security | Security Architecture | Threat Modelling | Risk Assessment | Secure SDLC | DevSecOps | Security-by-Design | Shift-Left Security | OWASP Top 10 | SAST | DAST | SCA | API Security | API Testing | Container Security | Cloud Security | CI/CD Security | Vulnerability Management

Experience with AWS, Azure, GCP, Kubernetes, Docker, microservices or other cloud‑native technologies will be advantageous.

about the manager/team

You will join an international Application Security and IT Security team working closely with software engineering, architecture, DevOps and DevSecOps teams.

The team operates in a highly collaborative and technically complex environment, where security is embedded into technology delivery rather than treated as a separate function.

You will work with experienced cybersecurity professionals and technical SMEs across different countries and disciplines, with opportunities to contribute ideas, introduce new security approaches and influence how security is implemented across critical applications and services.

The ideal candidate is a hands‑on Application Security professional who can combine strong technical security knowledge with the ability to influence developers, engineers, architects and business stakeholders.

experience

4 years

skills

application security, cyber security, DevSecOps, Agile, Cloud Native, SAST, DAST, SCA

qualifications

application security, cyber security, DevSecOps, Agile, Cloud Native, SAST, DAST, SCA

education

Bachelor Degree