Cybersecurity Engineer (Application Security - AI Assurance)

Assurity Trusted Solutions; Singapore; On-site; SGD 120,000 - 190,000; Full time

Job summary

Assurity Trusted Solutions (ATS) is a GovTech subsidiary driving secure digital outcomes. We seek engineers to build AI-assisted workflows that generate draft threat scenarios for Threat-Risk Assessments, design human-review-first processes, and create a centralized security knowledge base.

You will integrate code-security tooling and automate remediation suggestions across CI pipelines. The role requires strong Python programming, automation, and experience with code-scanning tools, cloud

Qualifications

• Experience with code-security and software-composition tools (Semgrep, CodeQL, SonarQube, Snyk, Checkmarx or equivalents).
• Experience analyzing VDP or bug-report data to identify vulnerability patterns and measure remediation outcomes.
• Experience processing penetration-test reports and generating code changes or remediation suggestions for review.

Responsibilities

• Build AI-assisted workflows to generate draft threat scenarios for TRAs from product info and prior assessments.
• Design human-review first workflows and move toward fuller TRA content as reliability improves.
• Create and maintain a security second brain supporting TRA work.

Skills

Python

Automation

Security engineering

Penetration testing

AI workflows

API integration

DevOps

Cloud platforms

Tools

Semgrep

CodeQL

SonarQube

Snyk

Checkmarx

Docker

AWS

Job description

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities:

• Build an AI-assisted workflow that generates draft threat scenarios for Threat-Risk Assessments (TRAs) from product information, prior assessments, threat patterns and the security second brain.
• Design the workflow for human review first, with a path towards generating more complete TRA content as reliability improves.
• Create and maintain the security second brain that supports TRA work.
• Curate threat scenarios, attack techniques, security patterns, prior assessments, product context and review lessons with reliable sources, useful metadata, traceability and clear handling of outdated or unreliable content.
• Build centralised code-scanning and white-box testing capabilities across source-code repositories and delivery pipelines to identify security bugs early.
• Integrate static analysis, dependency checks, secrets detection and other suitable checks, then help teams triage and fix meaningful findings.
• Create a separate knowledge base for recurring Vulnerability Disclosure Programme (VDP) issues.
• Analyse historical findings, identify repeated weaknesses and root causes, map them to coding patterns and preventive controls, and track measurable reduction in recurrence as a key performance indicator.
• Develop a controlled auto-patching workflow for vulnerabilities identified in penetration-test reports.
• Map findings to affected code or components, generate fixes or pull requests, run tests and security checks, validate that the finding is addressed, and work towards automatically applying safe fixes through a governed pipeline.
• Work closely with the Application Security lead, penetration tester and product engineers to validate findings, assess exploitability, review generated fixes and improve the quality of assurance outcomes.
• Create an MCP service for the CISO team so that approved internal tools can be called through a consistent and secure interface.
• Define authentication, authorisation, input validation, logging, error handling, data boundaries and human approval points for consequential actions.
• Build evaluation methods and test suites for AI-assisted assurance workflows.
• Measure the quality of generated TRA scenarios, code findings, proposed patches and tool calls, including false positives, missed issues, unsafe actions and cases requiring human intervention.
• Turn prototypes into maintainable services and reusable components with version control, testing, deployment, monitoring, documentation and operational support.
• Document security assumptions, limitations, residual risks and operating procedures.
• State clearly when an automated result is advisory, incomplete or unsuitable for direct action.

Experience & Skills:

• Experience with Semgrep, CodeQL, SonarQube, Snyk, Checkmarx or comparable code-security and software-composition tools.
• Experience analysing VDP or bug-report data, identifying recurring vulnerability patterns and measuring remediation or recurrence-reduction outcomes.
• Experience processing penetration-test reports and generating code changes, pull requests or automated remediation suggestions that can be tested and reviewed.
• Experience with retrieval-augmented generation, embeddings, vector search, knowledge graphs, document processing or maintaining a technical security knowledge base.
• Experience with MCP, tool gateways, agent registries, secure execution environments, Docker, AWS or other major cloud platforms.
• Experience Hands-on experience in application security, security engineering, penetration testing, secure software development, vulnerability research or a closely related technical security area.
• Strong programming and automation ability, preferably with Python, and experience integrating APIs, source-code tools, security platforms or developer workflows.
• Experience with code scanning, white-box testing, static analysis, dependency or secrets checking, secure code review, continuous integration and delivery pipelines, or comparable engineering practices.
• Experience building or operating AI applications, agents or workflow automation using large language models, tool calling, retrieval, structured outputs, evaluation or orchestration frameworks.
• Good understanding of web applications, APIs, authentication, authorisation, common vulnerability classes, cloud services, containers, networking and secure software delivery.
• Ability to investigate a security finding, reproduce or validate it, identify the af