Specialist, Application Security

TNG Digital Sdn Bhd; Kuala Lumpur; On-site; MYR 180,000 - 320,000; Full time

Job summary

TNG Digital Sdn Bhd in Kuala Lumpur seeks a Specialist, Application Security to plan and execute regular security testing across mobile and web apps, APIs, and infrastructure. You will work with risk, development and QA teams to identify and remediate vulnerabilities.

The role demands 5–7 years of offensive security experience, strong hands-on testing, and relevant certifications; OSCP/OSWE/OSCE and similar are preferred. This is a permanent on-site role in Kuala Lumpur.

Qualifications

• Bachelor’s degree required in CS/InfoSec or related field.
• Minimum 5–7 years of hands-on red teaming, penetration testing, or offensive security roles.
• Strong experience in web, mobile app, and API security testing; reverse engineering and tooling.

Responsibilities

• Plan and perform regular security tests on frontend and backend apps.
• Review backend APIs and web services regularly.
• Conduct vulnerability assessments across IT assets.
• Perform host configuration reviews on OS and network devices.
• Report vulnerabilities succinctly and drive remediation with stakeholders.
• Coordinate with risk, development, and QA teams to close issues.

Skills

Penetration testing

Web security

Mobile security

API security

Reverse engineering

Scripting

Exploit development

Offensive security

Threat modeling

Education

Bachelor’s degree in Computer Science, Information Security, or related technical field

Tools

Frida

Burp Suite

MobSF

Job description

# Specialist, *Application Security*Kuala Lumpur, MalaysiaPermanent#### Duties & Responsibilities* Responsible to plan and perform regular security test, monitoring and assessment on both frontend and backend application (mobile apps)* Responsible to plan and perform regular review of backend API/webservices* Responsible to perform regular vulnerability assessment across all enterprise IT assets* Responsible to conduct host configuration review on existing operating systems (servers/network devices)* Responsible to articulate and report discovered vulnerabilities in concise manners* Responsible to work closely with respective stakeholders in identifying the appropriate remediation.* Responsible to engage third party vendor to perform regular application penetration test and facilitate security assessment* Working closely with Risk team to ensure regular source code security review are performed and reported* Responsible to follow up any application vulnerabilities until closing. Working closely with development and QA team to ensure vulnerabilities are closed in time* To plan and perform out-of-the-box security assessment against enterprise infrastructure to identify existing security gaps#### Requirements* Bachelor’s degree in Computer Science, Information Security, or related technical field.* Minimum 5–7 years of hands-on experience in red teaming, penetration testing, or offensive security roles.* Strong technical expertise in:* Web and mobile app penetration testing (frontend/backend)* API and web service security testing* Mobile app (Android/iOS) reverse engineering and testing tools (e.g., Frida, Burp, MobSF)* OS and network-level assessment (Windows, Linux, network devices)* Secure SDLC, DevSecOps integration, and code scanning familiarity* Excellent scripting and automation skills (e.g., Python, Bash, PowerShell).* Prior experience in writing custom tools, exploits, or testing modules.* Strong reverse engineering skills for binaries or mobile apps.* Experience with CTF competitions, bug bounty, exploit development or security research publication is a plus.* Must be able to think out of the box, emulate real-world attacks, and identify unknown unknowns.* Offensive Security Certified Professional (OSCP)* OffSec OSWE, OSEP, or OSED* GIAC GPEN, GWAPT, GMOB, GXPN* Mobile Application Security Certification* Forensic related certification will be a plus.