Application Development Security Senior Analyst

Success Human Resource Centre Pte Ltd; Singapore; On-site; SGD 44,640 - 58,032; Full time

Benefits offered by this job

1-month completion bonus

Job summary

Success Human Resource Centre Pte Ltd in Singapore is seeking an Application Development Security Senior Analyst. This role acts as a bridge between Cybersecurity and Software Engineering, ensuring security is integrated into the Software Development Life Cycle.

The successful candidate will have a background in application security, with responsibilities including vulnerability management, code reviews, and training programs. This is a 1-year contract position with the possibility of permanent placement based on performance.

Qualifications

• 3+ years in application security, penetration testing, or secure software development.
• Deep understanding of web application vulnerabilities like SQLi, XSS, CSRF, SSRF.
• Ability to translate complex security risks into business impact for non-technical stakeholders.

Responsibilities

• Engage with stakeholders to establish and review secure development policies.
• Participate in threat modeling and risk assessments during the design phase.
• Conduct regular vulnerability scanning (SAST, DAST, SCA) and prioritize results.
• Perform manual secure code reviews to identify vulnerabilities.
• Assist in automating security checkpoints within CI/CD pipelines.
• Provide actionable guidance to developers for fixing security gaps.
• Lead secure coding workshops to foster a security-first culture.

Skills

Application Security

Penetration Testing

Secure Software Development

Java

Python

JavaScript

C#

Burp Suite

Checkmarx

Snyk

Veracode

Docker

Kubernetes

AWS

Azure

GCP

Education

Bachelor’s degree in Computer Science or Cybersecurity

Job description

The Application Development Security Senior Analyst is a critical bridge between the Cybersecurity and Software Engineering teams. You will ensure that security is not an afterthought but a foundational component of the Software Development Life Cycle (SDLC). Guided by our Secure Software Development Framework (SSDF), your mission is to find, fix, and prevent vulnerabilities in our proprietary software before they can be exploited.

Job Responsibilities

• Policy & Procedures: Engage with relevant stakeholders to establish and review corporate policy and procedures governing the secure development of applications.
• Security Architecture & Design: Participate in "Shift Left" initiatives by performing threat modeling and architectural risk assessments during the design phase.
• Vulnerability Management: Conduct regular SAST (Static), DAST (Dynamic), and SCA (Software Composition Analysis) scanning. Prioritize and triage results for development teams.
• Code Review: Perform manual secure code reviews to identify logic flaws and vulnerabilities (OWASP Top 10) that automated tools might miss.
• DevSecOps Integration: Assist in automating security checkpoints within CI/CD pipelines (e.g., Jenkins, GitLab CI, GitHub Actions).
• Remediation Guidance: Act as a consultant to developers, providing clear, actionable advice and code snippets to fix identified security gaps.
• Training & Advocacy: Lead "Security Champion" programs and conduct secure coding workshops to foster a security‑first culture.

Contract Details

• Period: 1 year contract position (convertible to permanent depending on KPI)
• Working Hours: Mon–Fri, 9am–6pm
• Salary: $4,000–$5,200 plus 1‑month completion bonus
• Location: Telok Ayer

Requirements

• Bachelor’s degree in Computer Science, Cybersecurity, or a related technical field (or equivalent experience).
• 3+ years in application security, penetration testing, or secure software development.
• Proficiency in at least one major language (e.g., Java, Python, JavaScript, or C#).
• Deep understanding of web application vulnerabilities (SQLi, XSS, CSRF, SSRF).
• Experience with security tools like Burp Suite, Checkmarx, Snyk, or Veracode.
• Familiarity with container security (Docker/Kubernetes) and Cloud environments (AWS/Azure/GCP).
• Certifications (Preferred): CSSLP, GWEB, CASE, or OSCP.
• Analytical Thinking: Ability to think like an attacker to foresee potential bypasses in application logic.
• Communication: Exceptional ability to translate complex security risks into business impact for non‑technical stakeholders.
• Collaboration: A "builder" mindset—focused on enabling developers to work fast and securely, rather than just acting as a gatekeeper.