Senior AppSec Engineer: Pen Tests & CI/CD Security

Carsome Sdn Bhd; Petaling Jaya; On-site; MYR 180,000 - 240,000; Full time

Job summary

Carsome Sdn Bhd is hiring a Senior Application Security Engineer to identify, validate, and drive remediation of security vulnerabilities across Carsome Group’s applications and DevSecOps pipelines. The role blends offensive security with DevSecOps engineering to scale security through automation.

This hands-on position requires expertise in internal/external penetration testing, OWASP Top 10/ASVS, and CI/CD security practices.

Qualifications

• 5+ years of experience in application security, penetration testing, or a related offensive security role.
• Hands-on web and API security testing using OWASP Top 10/ASVS.
• Experience with SAST/DAST/DAST tools and triaging findings.
• Familiarity with DevSecOps practices and CI/CD security.
• Relevant certifications (e.g., OSCP, GWAPT, CEH) are highly regarded.

Responsibilities

• Plan and execute internal penetration tests for web, mobile, and API apps.
• Triage findings from tooling (SAST/DAST/SCA) and bug bounty inputs.
• Embed security gates into CI/CD pipelines and reduce noise in tooling.
• Perform manual secure code review and threat modelling for high-risk features.
• Coordinate bug bounty engagements and external VAPT activities.

Skills

Penetration testing

Security assessment

Security reporting

Threat modelling

Security automation

Tools

Burp Suite Pro

GitLab CI/CD

Jira

Job description

Carsome Sdn Bhd is hiring a Senior Application Security Engineer to identify, validate, and drive remediation of security vulnerabilities across Carsome Group’s applications and DevSecOps pipelines. The role blends offensive security with DevSecOps engineering to scale security through automation.

This hands-on position requires expertise in internal/external penetration testing, OWASP Top 10/ASVS, and CI/CD security practices.