Hands-On Application Security Engineer – Payments & Crypto

MetaComp; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

MetaComp is a Singapore-based digital payment solutions provider seeking an experienced security engineer. The role focuses on defining security requirements, reviewing releases, and ensuring robust protection for money movement and authentication.

You will work with web and API security, threat modelling, and secure SDLC practices. Responsibilities include threat modelling, CI/CD security, incident response, and collaboration with developers to fix vulnerabilities.

Qualifications

• At least 4 years of hands-on web and API security work in applications.
• Experience in threat modelling of transactional flows and secure SDLC practices.
• Ability to explain security findings clearly to developers and product owners.
• Hands-on testing of web apps and APIs using intercepting proxies.

Responsibilities

• Set security requirements for applications and release gates (auth, auth, input validation, secrets handling).
• Review changes before release; threat model design; verify fixes and approve or flag issues.
• Test applications for business-logic flaws, race conditions, and replay risks.
• Define and tune CI security scanning (SAST/DAST/SCA) in CI/CD pipelines.
• Review cloud IAM roles and infrastructure-as-code with least privilege principles.
• Reproduce and hand findings to developers with clear fixes, then retest.

Skills

Web security

API security

Threat modelling

Code review

OWASP Top 10

CI/CD security

Python

Java

Tools

Intercepting proxy

SAST

DAST

SCA

Job description

MetaComp is a Singapore-based digital payment solutions provider seeking an experienced security engineer. The role focuses on defining security requirements, reviewing releases, and ensuring robust protection for money movement and authentication.

You will work with web and API security, threat modelling, and secure SDLC practices. Responsibilities include threat modelling, CI/CD security, incident response, and collaboration with developers to fix vulnerabilities.