Senior Security Engineer II

CARSOME; Petaling Jaya; On-site; MYR 120,000 - 150,000; Full time

Job summary

A leading digital automotive platform in Petaling Jaya seeks a Senior Security Engineer II to implement and maintain security infrastructures in cloud-native environments. This role focuses on GCP/AWS, automation, and collaboration with engineering teams while ensuring compliance with security standards and practices. The ideal candidate has significant cybersecurity experience and proven skills in DevSecOps and infrastructure security.

Qualifications

• Minimum of 5 years of hands-on experience in cybersecurity, preferably in fully cloud-native environments.
• Proven expertise in GCP/AWS security and DevSecOps.
• Strong understanding of ISO 27001 and regulatory standards.

Responsibilities

• Lead the implementation of cloud-native security tooling on GCP and AWS.
• Integrate security testing tools into CI/CD pipelines.
• Provide engineering support for threat detection and security operations.

Skills

Cloud-native security expertise

DevSecOps practices

Automation skills

Threat detection

Vulnerability management

Education

Bachelor’s degree in Computer Science, Cybersecurity, or related field

Tools

Terraform

Google Security Command Center

Cortex XSOAR

Job description

About You

The Senior Security Engineer II is a hands-on technical expert responsible for the implementation, automation, and maintenance of CARSOME’s security infrastructure. This role plays a key function in securing CARSOME’s cloud-native environments, with a strong focus on GCP/AWS, CI/CD pipeline hardening, DevSecOps practices, and SOAR playbook integration. Working closely with Engineering, DevOps, and Product teams, this position ensures that security is embedded across cloud workloads, applications, and infrastructure in line with the Cybersecurity Strategy 2025 and ISO 27001 controls.

Your Day-To-Day

A.Cloud Security Implementation:

• Lead the implementation of cloud-native security tooling on GCP and AWS.
• Secure cloud workloads using Google Security Command Center Enterprise (SCCE) and Google Cloud Armor.
• Define and enforce security governance policies across SaaS, PaaS, and IaaS environments.

B. DevSecOps & Automation:

• Integrate SAST, DAST, and SCA security testing tools into CI/CD pipelines.
• Automate vulnerability management and patching via infrastructure-as-code (IaC) tools (e.g., Terraform).
• Implement IAM role-based security controls and enforce least-privilege principles in DevOps workflows.

C. Cloud Infrastructure & Network Security:

• Provide technical input and security hardening support for the Secure Access Service Edge (SASE) architecture implemented by vendors.
• Review vendor & cloud configurations to validate security posture and alignment with Carsome standards.
• Enforce secure configurations across firewalls, access points, and cloud gateways.

D. Security Operations Support:

• Provide engineering and automation support for threat detection, system hardening, log telemetry, and policy enforcement.
• Integrate SOAR tools and develop automated playbooks for rapid incident response.
• Collaborate with MSOC, DFIR vendors to triage alerts and support audit control defense.
• Support digital forensic investigations and threat-hunting activities.

E. Collaboration & Documentation:

• Work with Engineering and DevOps teams to embed security into software development life cycles.
• Maintain up-to-date documentation for security tools, playbooks, and infrastructure.
• Participate in security review meetings and provide technical insights into risk mitigations.

Qualifications & Experiences:

• Bachelor’s degree in Computer Science, Cybersecurity, or a related field.
• Minimum of 5 years of hands-on experience in cybersecurity, preferably in fully cloud-native environments.
• Proven expertise in GCP/AWS security, DevSecOps, and infrastructure-as-code (e.g., Terraform, GitOps)
• Experience implementing and managing SOAR platforms and automated playbooks (e.g., Cortex XSOAR, Splunk SOAR, Google SecOps SOAR).
• In-depth knowledge of cloud security principles, threat detection, and vulnerability management using platforms such as Prisma Cloud, CrowdStrike, or SentinelOne.
• Strong understanding of integrating security into CI/CD pipelines using tools like GitLab, Jenkins, or GitHub Actions.
• Familiarity with ISO 27001, SOX, and other regulatory standards relevant to cloud-native security.
• Must be able to demonstrate practical delivery experience—such as infrastructure hardening, threat mitigation, or audit remediation.
• This is an implementation-focused role. Candidates who are unable to provide real-world, execution-based examples of their contributions need not apply.