CyberSecurity Analyst (Application Security)

FPT Asia Pacific Pte Ltd; Singapore; On-site; SGD 70,000 - 110,000; Full time

Job summary

FPT Asia Pacific Pte Ltd in Singapore is seeking a Cybersecurity Analyst specializing in Application Security to assess vulnerabilities across enterprise apps and development projects.

You will work with development, DevOps and security teams to review findings, advise remediation, and support secure SDLC and DevSecOps practices.

Qualifications

• Degree or Diploma in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline.
• Approximately 3–5 years of relevant experience in Cybersecurity, Application Security, Vulnerability Management, or DevSecOps.
• Hands-on experience analysing application security vulnerabilities and collaborating with development teams on remediation.
• Experience supporting security risk assessments, security waivers, and risk acceptance processes.

Responsibilities

• Conduct application security reviews and assessments across applications and development projects.
• Review and analyse security findings from SAST, SCA, and DAST tools.
• Assess vulnerabilities based on exploitability, business impact, and code paths.
• Identify false positives and mitigations; collaborate with teams for remediation.
• Track vulnerabilities and remediation activities through to closure.
• Support vulnerability triage and security investigations as needed.

Skills

SAST

SCA

DAST

Vulnerability management

OWASP Top 10

Secure SDLC

DevSecOps

CI/CD security

Cloud security basics

Vulnerability triage

Education

Bachelor's or Diploma in Cybersecurity/ IT/ CS/ Engineering

Relevant certifications or ongoing education

Tools

SAST tools

SCA tools

DAST tools

Job description

Role Overview

We are seeking a Cybersecurity Analyst specialising in Application Security to assess, identify, and manage security vulnerabilities across enterprise applications and development projects.

The successful candidate will work closely with development, DevOps, and security teams to evaluate application security risks, review vulnerability findings, recommend remediation measures, and support the implementation of security controls throughout the Software Development Life Cycle (SDLC).

Key Responsibilities

Application Security & Vulnerability Management

• Conduct application security reviews and assessments across applications and development projects.
• Review and analyse security findings from Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST) tools.
• Assess application and dependency vulnerabilities based on exploitability, business impact, application context, and reachable code paths.
• Identify false positives, non-applicable vulnerabilities, and potential security risks.
• Collaborate with development and DevOps teams to recommend remediation and mitigation measures.
• Track security vulnerabilities and remediation activities through to closure.

Security Risk Assessment & Governance

• Review security waiver and risk acceptance requests, including supporting justifications, compensating controls, and residual risks.
• Conduct or support application and cloud security risk assessments for new systems, application enhancements, APIs, and technology implementations.
• Evaluate security risks and provide recommendations aligned with organisational security policies and industry best practices.
• Support vulnerability triage and security incident investigations when required.

DevSecOps & Security Integration

• Support the integration and operation of application security controls within DevOps and CI/CD pipelines.
• Implement and maintain security scanning processes, automated security checks, and security gates.
• Promote secure coding practices and security awareness among development teams.
• Support continuous improvement of Secure SDLC and DevSecOps processes.

Requirements & Qualifications

Education & Experience

• Degree or Diploma in Cybersecurity, Information Technology, Computer Science, Engineering, or a related discipline.
• Approximately 3-5 years of relevant experience in Cybersecurity, Application Security, Vulnerability Management, or DevSecOps.
• Hands-on experience analysing application security vulnerabilities and collaborating with development teams on remediation.
• Experience supporting security risk assessments, security waivers, and risk acceptance processes.

Technical Skills

• Practical experience with SAST, SCA, DAST, and vulnerability management tools.
• Strong understanding of OWASP Top 10, web application security, API security, and common application vulnerabilities.
• Ability to assess vulnerabilities beyond CVSS severity, considering exploitability, application context, and reachable code paths.
• Good understanding of Secure SDLC, DevSecOps, CI/CD security controls, and software dependency management.
• Knowledge of cloud security fundamentals, preferably AWS.
• Familiarity with application security scanning, vulnerability triage, and remediation processes.

Preferred Skills & Certifications

• Exposure to Cloud-Native Application Protection Platforms (CNAPP), Cloud Security Posture Management (CSPM), SIEM, or other cybersecurity platforms.
• Experience supporting security incident investigations or vulnerability triage.
• Relevant cybersecurity certifications such as CSSLP, CISSP, CCSP, GIAC application security certifications, or equivalent.