Application Security Engineer

MetaComp; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

MetaComp is a Singapore-based digital payment solutions provider seeking an experienced security engineer. The role focuses on defining security requirements, reviewing releases, and ensuring robust protection for money movement and authentication.

You will work with web and API security, threat modelling, and secure SDLC practices. Responsibilities include threat modelling, CI/CD security, incident response, and collaboration with developers to fix vulnerabilities.

Qualifications

• At least 4 years of hands-on web and API security work in applications.
• Experience in threat modelling of transactional flows and secure SDLC practices.
• Ability to explain security findings clearly to developers and product owners.
• Hands-on testing of web apps and APIs using intercepting proxies.

Responsibilities

• Set security requirements for applications and release gates (auth, auth, input validation, secrets handling).
• Review changes before release; threat model design; verify fixes and approve or flag issues.
• Test applications for business-logic flaws, race conditions, and replay risks.
• Define and tune CI security scanning (SAST/DAST/SCA) in CI/CD pipelines.
• Review cloud IAM roles and infrastructure-as-code with least privilege principles.
• Reproduce and hand findings to developers with clear fixes, then retest.

Skills

Web security

API security

Threat modelling

Code review

OWASP Top 10

CI/CD security

Python

Java

Tools

Intercepting proxy

SAST

DAST

SCA

Job description

MetaComp Pte Ltd is a leading Singapore-based digital payment solution provider, licensed and regulated by the Monetary Authority of Singapore (MAS) as a Major Payment Institution, to provide Digital Payment Token Services and Cross-border Payment Transfers. Operating under a P2B2C (platform-to-business, partners-to-clients) model, MetaComp provides its clients with an integrated end-to-end suite of services, empowering them to confidently enter the digital asset market with much-needed safety, security, and compliance assurance. Together with its parent company, Metaverse Green Exchange Pte. Ltd. (a MAS-licensed CMS holder permitted to carry out, inter alia, brokerage and custody services), MetaComp introduces its suite of services through CAMP (Client Assets Management Platform) which allow businesses to develop and scale their digital asset offerings through various products and/or services such as over-the-counter transactions, fiat payments, digital asset custody and prime brokerage.

Sets the security requirements for our applications and reviews every significant change before it ships, from feature releases to major refactoring. The focus is business logic: our platforms handle payments and digital assets, so the flaws that matter most involve money movement. Developers own the fixes: this role sets the bar, finds the issues and verifies they are fixed. Hands-on individual contributor role.

Responsibilities

• Set the security requirements for our applications: what new features, APIs and services must meet before release (e.g. authentication, authorisation, input validation, secrets handling, logging, money-movement controls).
• Review changes before they ship, from feature releases to major refactoring and re-architecture: threat model the design, review the code and test the change, then sign off or name what must be fixed first. Changes touching payments, payouts, balances or authentication get the deepest review, covering authorisation, request signing and replay protection, money-movement logic and cryptography.
• Test our applications for business-logic flaws, such as race conditions and double spends, amount tampering, broken authorisation, payout and withdrawal abuse, and request replay.
• Set the standard for application security scanning in CI (SAST, DAST, SCA, secrets scanning): which scans run, which findings block a merge, and exceptions for high and critical findings. Tune the rules so developers fix most findings themselves; the CI/CD platform itself is secured by our cloud infrastructure security engineer.
• For new services and significant changes, review how apps use cloud IAM roles, secrets and infrastructure as code: least privilege, no hard-coded or long-lived credentials, no unintended exposure.
• Reproduce payment-abuse cases flagged by our risk team that may have a security cause; confirm whether a code or design fix is needed.
• Hand findings to the owning developers with clear fix guidance, track them to closure, and retest before closing.
• Respond hands-on to application and payment incidents as the area expert.
• Keep security requirements, review sign-offs, test reports, scan results and fix records as audit evidence.

Requirements

General

• At least 4 years of hands-on web and API security work in application security, product security, penetration testing or full-time bug bounty research.
• Has taken web app or API security issues from discovery to verified closure, working with the developers who fixed them (in-house, consultancy or bug bounty).
• Programs in Python and Java: Python for security testing and automation (e.g. race-condition scripts), Java (Spring Boot) for reading and reviewing backend code and giving developers clear fix guidance.
• Has learned an adjacent skill and applied it to security work (e.g. cloud, CI tooling, infrastructure as code).
• Explains security requirements and review findings clearly to developers and product owners, and holds the line on what must be fixed before release.
• Works independently and owns an area end to end.
• Checks their own work and stands behind it; uses AI tools to go faster, but understands and verifies the output.

Technical

• Security requirements and change review: has written security requirements for applications and reviewed features, releases or re-architecture before they shipped.
• Business logic: has found and reported flaws in multi-step transactional flows (e.g. checkout, booking, account, balance).
• Manual testing: has tested web apps and APIs with an intercepting proxy and found issues scanners missed.
• OWASP: applies the Top 10 and API Security Top 10 in testing and code review.
• API authentication and signing: has reviewed or tested schemes, e.g. OAuth 2.0/OIDC, JWT, API keys or HMAC request signing with replay protection.
• Code review: finds security flaws in Java and Spring Boot backend code (e.g. Spring Security misconfiguration, exposed actuator endpoints, mass assignment, unsafe deserialisation) and recommends fixes for developers to make.
• Threat modelling: can threat model application and transaction flows at design stage (any method, e.g. STRIDE).
• Secure SDLC: has worked with at least two of SAST, DAST, SCA and secrets scanning (set up in CI, tuned rules, or triaged findings with developers).
• Cloud: knows cloud IAM well enough to review an application's use of roles and secrets (e.g. role permissions, service-to-service access, secret storage and retrieval).
• Infrastructure as code: reviews it for application stacks and raises fixes (Terraform preferred).

Nice to have

• Security work on card, bank transfer, wallet, gateway or payout flows.
• Wallet and custody security: hot and cold wallet controls, key handling, transaction signing and approval.
• Web3: fiat–crypto on/off-ramps and reading smart contracts.
• Mobile app security testing.
• Bug bounty triage: validating reports, rating severity, confirming fixes.
• AI/LLM security automation (e.g. agent loops, test harnesses).
• Certifications, e.g. OSWE, BSCP, CREST CCT APP or CRT, OSWA, GWAPT, CSSLP.

We are committed to creating an inclusive workplace where every individual feels respected, valued, and empowered to contribute. We celebrate diversity in all its forms—background, ethnicity, gender, identity, orientation, experience, and thought and believe it strengthens our culture and our work. We are proud to be an equal opportunity employer and do not discriminate on the basis of race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, disability, or any other protected characteristic.