App Security Engineer: Threat Modelling & Secure SDLC

QUESSCORP SOLUTIONS PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

QUESSCORP SOLUTIONS PTE. LTD. seeks an experienced Application Security Lead to drive security reviews across Java and Go applications, including manual code audits and remediation guidance. You will assess architecture and data flows, define secure SDLC standards, and build tooling to detect vulnerabilities at scale.

The role requires hands-on experience with OWASP Top 10, threat modelling, pen testing, and secure coding guidance. Strong English communication and leadership are essential.

Qualifications

• Bachelor's degree in Computer Science, Engineering, Information Security or related field, or equivalent practical experience.
• 6+ years of professional application security experience with technical ownership across engineering teams.
• Strong Java and/or Go skills with hands-on auditing experience (Spring/Gin).
• Deep understanding of OWASP Top 10 and business logic, access control and authentication issues.
• Experience in threat modelling, secure architecture reviews, penetration testing and SDL implementation.
• Experience developing or customizing code analysis tooling to detect vulnerabilities.
• Demonstrated vulnerability research track record (CVE disclosures, bug bounties).
• Ability to evaluate security trade-offs, set standards and guide remediation across complex apps.
• Strong English communication and documentation skills.

Responsibilities

• Lead application security reviews, including manual code audits of Java and Go apps and provide remediation guidance.
• Assess architecture, logic and data flows to identify risks and design appropriate controls.
• Define secure development standards and integrate security checks into SDL.
• Build or tune tooling to catch common vulnerabilities early and at scale.
• Perform threat modelling, secure architecture reviews, and pen tests of web, backend and mobile/desktop apps.
• Investigate emerging vulnerabilities and guide remediation impact.
• Review and improve security controls for sensitive systems and SOPs.
• Collaborate with engineering teams to prioritize findings and verify fixes address root causes.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Skills

Java

Go

Spring

Gin

Security reviews

Threat modelling

Penetration testing

Code analysis tooling

Communication skills

Documentation

Education

Bachelor's degree in Computer Science, Engineering, Information Security or a related field, or equivalent practical experience

Tools

Static analysis tooling

Dynamic analysis tooling

Bytecode analysis

Control-flow analysis

Job description

QUESSCORP SOLUTIONS PTE. LTD. seeks an experienced Application Security Lead to drive security reviews across Java and Go applications, including manual code audits and remediation guidance. You will assess architecture and data flows, define secure SDLC standards, and build tooling to detect vulnerabilities at scale.

The role requires hands-on experience with OWASP Top 10, threat modelling, pen testing, and secure coding guidance. Strong English communication and leadership are essential.