Application Security Engineer

Liberty in Asia Pacific; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Liberty in Asia Pacific is seeking an Application Security Engineer to embed security into the software development lifecycle across APAC markets. You will partner with engineering teams to shift security left, automate controls, and deliver secure software at speed.

Your work will support compliance with cyber risk requirements issued by regulators in APAC and involve threat modeling, secure code reviews, and secure-by-default pipeline design.

Qualifications

• 5+ years of experience in application security or related field.
• Strong knowledge of OWASP Top 10 and web/API security.
• Experience integrating security tooling into CI/CD pipelines.
• Cloud security in AWS/Azure, including IAM and container security.
• Threat modeling using STRIDE.
• Familiarity with APAC regulatory guidance for insurers.
• Certifications such as OSCP/OSWE or AWS Security.

Responsibilities

• Design, implement, and maintain security automation across CI/CD pipelines, including SAST, DAST, and secret detection.
• Conduct secure code reviews for deployments and designs, providing actionable feedback.
• Partner with engineering for threat modeling and architecture risk assessments.
• Triage, prioritize, and remediate vulnerabilities from automated tooling and tests.
• Develop secure-by-default frameworks and pipelines to make security the easier path for developers.
• Maintain SOPs for DevSecOps, security gates, and incident response playbooks; ensure regulatory alignment.

Skills

Application security

Secure coding practices

OWASP Top 10

Threat modeling (STRIDE)

CI/CD security integration

Cloud security (AWS, Azure)

Security tooling in CI/CD

Bug bounty / red team kind experience

Open-source security contributions

Supply chain security initiatives

Regulatory awareness for APAC insurers

Tools

GitHub Actions

Contrast

Rapid7

Tenable

Wiz

Codacy

CodeQL

Jenkins

Job description

We\'re looking for an Application Security Engineer with a DevSecOps mindset to help us build security into every stage of our software development lifecycle across our APAC insurance markets. You\'ll partner with engineering teams to shift security left, automate security controls, and ensure our applications and infrastructure remain resilient against evolving threats — while meeting the cyber and technology risk expectations of insurance regulators across the region. This is a hands-on role for someone who enjoys writing code, breaking things (responsibly), and empowering developers to ship secure software at speed.

Your work will support compliance with cyber and technology risk requirements issued by insurance regulators in our APAC markets, including:

• Singapore – Monetary Authority of Singapore (MAS): Notice 127 on Cyber Hygiene, TRM Guidelines
• Hong Kong – Hong Kong Insurance Authority (HKIA): GL20 on Cybersecurity
• Australia – Australian Prudential Regulation Authority (APRA): CPS 234 (Information Security), CPS 230 (Operational Risk Management)
• Malaysia – Bank Negara Malaysia (BNM): Risk Management in Technology (RMiT)
• China – National Financial Regulatory Administration (NFRA)
• India – Insurance Regulatory and Development Authority of India (IRDAI): Information and Cyber Security Guidelines

Responsibilities:

• Design, implement, and maintain security automation across CI/CD pipelines, including SAST, DAST, and secret detection
• Conduct secure code reviews for change deployments and new designs — review pull requests, release candidates, and infrastructure changes to identify security defects before they reach production; provide actionable, context-rich feedback that helps developers ship securely and on time
• Partner with engineering teams to perform threat modeling, secure code reviews, and architecture risk assessments for new features, services, and system designs — ensuring security is embedded from the earliest design stages through implementation
• Triage, prioritize, and remediate vulnerabilities discovered through automated tooling, bug bounty programs, and penetration tests
• Build and maintain secure-by-default frameworks, libraries, and paved-road templates that make the secure path the easy path for developers
• Develop, maintain, and continuously improve SOPs and guidelines for DevSecOps — define standardised operating procedures covering secure development lifecycle, pipeline security gates, vulnerability handling workflows, secure release processes, and incident response playbooks; ensure guidelines are practical, adopted by engineering teams, and aligned with regulatory expectations
• Ensure AppSec controls and evidence support the regulatory obligations of our APAC markets (e.g., APRA CPS 234 information security capability, MAS TRM secure development, BNM RMiT software lifecycle controls)
• Develop and deliver security training and documentation to raise the security baseline across engineering
• Respond to security incidents, conduct root cause analysis, and drive systemic improvements
• Contribute to our vulnerability management program, including SLAs, metrics, and reporting to engineering leadership and to GRC teams supporting regulatory submissions
• Escalate unresolved security issues and non-compliances to the CISO — identify and formally escalate risks that remain unresolved beyond defined SLAs, regulatory non-compliances, or exceptions that exceed accepted risk appetite, ensuring executive visibility and timely decision-making
• Champion a healthy security culture through collaboration rather than gatekeeping

Experience & Qualification Requirements:

• 5+ years of experience in application security, software engineering, or a closely related field
• Strong understanding of OWASP Top 10, CWE/SANS Top 25, and common web/API attack patterns
• Hands-on experience integrating security tooling into CI/CD pipelines (GitHub Actions, Contrast, Rapid7, Tenable, Wiz, Codacy, CodeQL, Jenkins, etc.)
• Working knowledge of cloud security in AWS, Azure, including IAM, network controls, and container security
• Experience performing threat modeling using frameworks like STRIDE.
• Awareness of cyber and technology risk regulations applicable to insurers in APAC (MAS, HKIA, APRA, BNM, NFRA, IRDAI)
• Strong written and verbal communication skills, especially when explaining security concepts to non-security audiences
• Experience with bug bounty programs, red team engagements, or offensive security
• Contributions to open-source security tools or published security research
• Familiarity with SBOM, SLSA, sigstore, or other supply chain security initiatives
• Relevant certifications (OSCP, OSWE, AWS Security Specialty, or equivalent)
• Background in regulated environments — insurance, banking, or other financial services preferred