Application Security Engineer

GovTech Singapore; Singapore; On-site; SGD 90,000 - 150,000; Full time

Benefits offered by this job

Flexible work arrangements

Wellness programs

Total rewards approach

Job summary

GovTech Singapore is seeking an Application Security Engineer to strengthen the security of internally developed products by embedding security into the software development lifecycle. You will partner with engineering and infrastructure security teams to identify risks early, improve CI/CD security controls, and deliver secure applications from design through deployment.

You will embed security checks into CI/CD pipelines (SAST, DAST, software composition analysis, secret detection) and promote

Qualifications

• Strong understanding of web and API security principles.
• Experience with application security testing tools such as Burp Suite and OWASP ZAP.
• Ability to read and understand code in Python, Java, or JavaScript.
• Familiarity with CI/CD security practices and threat modeling.

Responsibilities

• Own and deliver application security assurance for internally developed products, integrating security practices throughout the SDLC.
• Embed security checks into CI/CD pipelines, including SAST, DAST, software composition analysis, and secret detection.
• Promote shift-left security by advising development teams on secure design, implementation, and coding practices.
• Conduct targeted code reviews to uncover flaws before formal penetration testing.
• Collaborate with the Infrastructure Security Specialist to validate vulnerabilities and risk scenarios ahead of formal testing.
• Review third-party penetration test results, validate findings, prioritize risks, and recommend practical remediation.
• Conduct threat modeling and help strengthen the security of APIs, web applications, and modern application architectures.
• Work with engineering teams to track remediation and improve security practices across development and release workflows.
• Communicate technical findings clearly, translating vulnerabilities into business and operational risks.
• Strong communication skills, with the ability to explain vulnerabilities to varied audiences.

Skills

OWASP Top 10 knowledge

OWASP API Top 10 knowledge

Web security principles

API security

Read code (Python/Java/JavaScript)

Tools

Burp Suite

OWASP ZAP

Postman

Proxy debuggers

Job description

GovTech is the lead agency driving Singapore’s Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government’s capabilities in Data Science & Artificial Intelligence, Application Development, Smart City Technology, Digital Infrastructure, and Cybersecurity.

At GovTech, we offer you a purposeful career to make lives better where we empower our people to master their craft through robust learning and development opportunities all year round.

Play a part in Singapore’s vision to build a Smart Nation and embark on your meaningful journey to build tech for public good. Join us to advance our mission and shape your future with us today!

Learn more about GovTech at tech.gov.sg.

Job Description Summary

As an Application Security Engineer, you will strengthen the security of internally developed products by embedding security into the software development lifecycle. You will partner with engineering and infrastructure security teams to identify and address risks early, improve CI/CD security controls, and help deliver secure applications from design through deployment.

• Own and deliver application security assurance for internally developed products, integrating security practices throughout the SDLC.
• Embed security checks into CI/CD pipelines, including SAST, DAST, software composition analysis, and secret detection, to identify vulnerabilities early and support timely remediation.
• Promote shift-left security by advising development teams on secure design, implementation, and coding practices.
• Conduct targeted code reviews to uncover flaws before formal penetration testing.
• Collaborate with the Infrastructure Security Specialist to validate vulnerabilities and risk scenarios ahead of formal testing.
• Review third-party penetration test results, validate findings, prioritize risks, and recommend practical remediation.
• Conduct threat modeling and help strengthen the security of APIs, web applications, and modern application architectures.
• Work with engineering teams to track remediation and improve security practices across development and release workflows.
• Communicate technical findings clearly, translating vulnerabilities into business and operational risks.
• Solid knowledge of web and API security principles, including the OWASP Top 10 and OWASP API Security Top 10.
• Familiarity with modern application architectures, especially authentication, authorization, and session management.
• Ability to read and understand code in languages such as Python, Java, or JavaScript.
• Experience with application security testing tools such as Burp Suite, OWASP ZAP, Postman, and proxy debuggers.
• Understanding of threat modeling, business logic vulnerabilities, and risk-based prioritization.
• Knowledge of CI/CD security practices, including integrating SAST, DAST, and open-source dependency scanning into development workflows.
• Strong communication skills, with the ability to explain technical vulnerabilities and remediation options to varied audiences.

What we offer you:

GovTech is an equal opportunity employer committed to fostering an inclusive workplace that values diverse voices and perspectives, as we believe that diversity is the foundation to innovation.

Our employee benefits are based on a total rewards approach, offering a holistic and market-competitive suite of perks. These include leave benefits to meet your work-life needs and employee wellness programs.

We champion flexible work arrangements (subject to your job role) and trust that you will manage your own time to deliver your best, wherever you are, and whatever works best for you.

Learn more about life inside GovTech at go.gov.sg/GovTechCareers.

Stay connected with us on social media at go.gov.sg/ConnectWithGovTech