Cybersecurity Engineer (Application Security - AI Assurance)

Assurity Trusted Solutions Pte Ltd; Singapore; On-site; SGD 100,000 - 167,000; Full time

Benefits offered by this job

GovTech backing

Learning culture

Contract staff benefits

Job summary

Assurity Trusted Solutions Pte Ltd is seeking an experienced security engineer to lead AI‑assisted workflows for Threat‑Risk Assessments. You will design and implement a solutions stack that generates draft TRA content from product information and threat patterns, with human review at the forefront.

The role focuses on building a secure knowledge base, centralized code‑scanning capabilities, and automated remediation workflows across CI/CD pipelines, collaborating with the Application Security

Qualifications

• Hands-on in application security, security engineering or related security area.

Responsibilities

• Build an AI-assisted workflow generating draft threat scenarios for TRAs.
• Create a security second brain to support TRA work with reliable data and metadata.
• Build centralized code-scanning across repositories and pipelines with static analysis and secrets checks.
• Develop a knowledge base for VDP issues, track recurrence reductions.
• Develop auto-patching workflow for vulnerabilities from PT reports with governed pipeline.
• Collaborate with security leads, testers and engineers to validate findings.
• Define MCP service interfaces for the CISO team with secure authentication and governance.
• Create evaluation methods and test suites for AI-assisted assurance workflows.
• Turn prototypes into maintainable services with version control, tests, deployment and monitoring.
• Document security assumptions, limitations and operating procedures.

Skills

Python programming

Automation

API integration

Large language models

Tools

Semgrep

CodeQL

SonarQube

Snyk

Checkmarx

Docker

AWS

Job description

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech).As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities

• Build an AI-assisted workflow that generates draft threat scenarios for Threat‑Risk Assessments (TRAs) from product information, prior assessments, threat patterns and the security second brain. Design the workflow for human review first, with a path towards generating more complete TRA content as reliability improves.
• Create and maintain the security second brain that supports TRA work. Curate threat scenarios, attack techniques, security patterns, prior assessments, product context and review lessons with reliable sources, useful metadata, traceability and clear handling of outdated or unreliable content.
• Build centralised code‑scanning and white‑box testing capabilities across source‑code repositories and delivery pipelines to identify security bugs early. Integrate static analysis, dependency checks, secrets detection and other suitable checks, then help teams triage and fix meaningful findings.
• Create a separate knowledge base for recurring Vulnerability Disclosure Programme (VDP) issues. Analyse historical findings, identify repeated weaknesses and root causes, map them to coding patterns and preventive controls, and track measurable reduction in recurrence as a key performance indicator.
• Develop a controlled auto‑patching workflow for vulnerabilities identified in penetration‑test reports. Map findings to affected code or components, generate fixes or pull requests, run tests and security checks, validate that the finding is addressed, and work towards automatically applying safe fixes through a governed pipeline.
• Work closely with the Application Security lead, penetration tester and product engineers to validate findings, assess exploitability, review generated fixes and improve the quality of assurance outcomes.
• Create an MCP service for the CISO team so that approved internal tools can be called through a consistent and secure interface. Define authentication, authorisation, input validation, logging, error handling, data boundaries and human approval points for consequential actions.
• Build evaluation methods and test suites for AI‑assisted assurance workflows. Measure the quality of generated TRA scenarios, code findings, proposed patches and tool calls, including false positives, missed issues, unsafe actions and cases requiring human intervention.
• Turn prototypes into maintainable services and reusable components with version control, testing, deployment, monitoring, documentation and operational support.
• Document security assumptions, limitations, residual risks and operating procedures. State clearly when an automated result is advisory, incomplete or unsuitable for direct action.

Requirements

• Experience with Semgrep, CodeQL, SonarQube, Snyk, Checkmarx or comparable code‑security and software‑composition tools.
• Experience analysing VDP or bug‑report data, identifying recurring vulnerability patterns and measuring remediation or recurrence‑reduction outcomes.
• Experience processing penetration‑test reports and generating code changes, pull requests or automated remediation suggestions that can be tested and reviewed.
• Experience with retrieval‑augmented generation, embeddings, vector search, knowledge graphs, document processing or maintaining a technical security knowledge base.
• Experience with MCP, tool gateways, agent registries, secure execution environments, Docker, AWS or other major cloud platforms

Experience

• Hands‑on experience in application security, security engineering, penetration testing, secure software development, vulnerability research or a closely related technical security area.
• Strong programming and automation ability, preferably with Python, and experience integrating APIs, source‑code tools, security platforms or developer workflows.
• Experience with code scanning, white‑box testing, static analysis, dependency or secrets checking, secure code review, continuous integration and delivery pipelines, or comparable engineering practices.
• Experience building or operating AI applications, agents or workflow automation using large language models, tool calling, retrieval, structured outputs, evaluation or orchestration frameworks.
• Good understanding of web applications, APIs, authentication, authorisation, common vulnerability classes, cloud services, containers, networking and secure software delivery.
• Ability to investigate a security finding, reproduce or validate it, identify the affected code or component, and judge whether a proposed fix addresses the underlying weakness without introducing a regression.
• Ability to design secure tool integrations, including least‑privilege access, input validation, approval gates, secrets handling, logging, monitoring and protection against data leakage or unsafe actions.
• Strong written communication and the judgement to explain technical findings, automation limitations and residual risk to both security practitioners and product teams.

Join us and discover a meaningful and exciting career with Assurity Trusted Solutions!

The remuneration package will commensurate with your qualifications and experience.

We thank you for your interest and please note that only shortlisted candidates will be notified.

Benefits

• A wholly-owned subsidiary of GovTech.
• We promote a learning culture and encourage you to grow and learn.
• Contract Staff enjoys the same benefits as Permanent Employees.