Senior AppSec Engineer: Lead Secure SDLC & Risk

DKSH; Kuala Lumpur; On-site; MYR 140,000 - 230,000; Full time

Job summary

DKSH is seeking an Application Security Engineer to safeguard its digital landscape across the software development lifecycle. You will coordinate penetration testing, drive vulnerability management, and govern AppSec practices to protect internal, third‑party, and internet-facing applications.

You will own remediation tracking, provide practical guidance for fixes, and collaborate with SOC, developers, and QA to embed security into delivery and releases.

Qualifications

• Bachelor's degree in Cybersecurity, CS, Software Engineering, IT or equivalent practical experience.
• 5+ years of cybersecurity experience with focus on application security or security assurance.
• Experience in application penetration testing coordination and remediation tracking.
• Strong knowledge of OWASP Top 10, API security, and secure coding.
• Experience with Burp Suite, Invicti, ZAP, Qualys and related tooling.

Responsibilities

• Coordinate and manage application penetration testing activities across teams.
• Conduct or support security assessments for web, API, mobile, cloud, and enterprise apps.
• Own vulnerability tracking from discovery to remediation with proper categorization.
• Provide actionable remediation guidance for common vulnerabilities (SQLi, XSS, auth flaws, etc.).
• Support secure SDLC activities including threat modeling inputs and security reviews.
• Prepare executive and technical reports on findings and risk themes.
• Drive remediation coordination with owners, developers, QA, and security teams.
• Collaborate with SOC and infrastructure to strengthen prevention and detection of application attacks.
• Champion secure-by-design and risk-based delivery practices.

Education

Bachelor's degree in Cybersecurity / CS / IT

Tools

Burp Suite

Invicti

OWASP ZAP

Qualys

Microsoft Defender

SAST/DAST/SCA tooling

Job description

DKSH is seeking an Application Security Engineer to safeguard its digital landscape across the software development lifecycle. You will coordinate penetration testing, drive vulnerability management, and govern AppSec practices to protect internal, third‑party, and internet-facing applications.

You will own remediation tracking, provide practical guidance for fixes, and collaborate with SOC, developers, and QA to embed security into delivery and releases.