Application Security Engineer: Secure SDLC & CI/CD

GovTech Singapore; Singapore; On-site; SGD 90,000 - 150,000; Full time

Benefits offered by this job

Flexible work arrangements

Wellness programs

Total rewards approach

Job summary

GovTech Singapore is seeking an Application Security Engineer to strengthen the security of internally developed products by embedding security into the software development lifecycle. You will partner with engineering and infrastructure security teams to identify risks early, improve CI/CD security controls, and deliver secure applications from design through deployment.

You will embed security checks into CI/CD pipelines (SAST, DAST, software composition analysis, secret detection) and promote

Qualifications

• Strong understanding of web and API security principles.
• Experience with application security testing tools such as Burp Suite and OWASP ZAP.
• Ability to read and understand code in Python, Java, or JavaScript.
• Familiarity with CI/CD security practices and threat modeling.

Responsibilities

• Own and deliver application security assurance for internally developed products, integrating security practices throughout the SDLC.
• Embed security checks into CI/CD pipelines, including SAST, DAST, software composition analysis, and secret detection.
• Promote shift-left security by advising development teams on secure design, implementation, and coding practices.
• Conduct targeted code reviews to uncover flaws before formal penetration testing.
• Collaborate with the Infrastructure Security Specialist to validate vulnerabilities and risk scenarios ahead of formal testing.
• Review third-party penetration test results, validate findings, prioritize risks, and recommend practical remediation.
• Conduct threat modeling and help strengthen the security of APIs, web applications, and modern application architectures.
• Work with engineering teams to track remediation and improve security practices across development and release workflows.
• Communicate technical findings clearly, translating vulnerabilities into business and operational risks.
• Strong communication skills, with the ability to explain vulnerabilities to varied audiences.

Skills

OWASP Top 10 knowledge

OWASP API Top 10 knowledge

Web security principles

API security

Read code (Python/Java/JavaScript)

Tools

Burp Suite

OWASP ZAP

Postman

Proxy debuggers

Job description

GovTech Singapore is seeking an Application Security Engineer to strengthen the security of internally developed products by embedding security into the software development lifecycle. You will partner with engineering and infrastructure security teams to identify risks early, improve CI/CD security controls, and deliver secure applications from design through deployment.

You will embed security checks into CI/CD pipelines (SAST, DAST, software composition analysis, secret detection) and promote