IT Security Officer (Application Security & Cloud Computing)

CMC-APAC PRIVATE LIMITED; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

CMC-APAC PRIVATE LIMITED is seeking an experienced Application Security Officer to strengthen cybersecurity risk management across on‑prem and cloud environments in Singapore. The role focuses on reviewing architectures, APIs, and data flows to identify security risks and ensure remediations align with best practices.

You will drive threat modelling and secure development throughout projects. The candidate should bring 5+ years in software development, application security, and cloud computing,

Qualifications

• Minimum 5 years in software development, application security and cloud environments.
• Familiarity with REST, SOAP, and SSL/TLS in web/mobile apps.
• Understanding of OWASP Top 10 and ASVS standards.

Responsibilities

• Assess security risks for applications, infra, and cloud services.
• Review architectures, data flows, APIs, and entry points for risks.
• Develop threat models and remediation strategies for projects.
• Monitor vulnerabilities and ensure timely fixes.
• Lead security incident response and post-incident reviews.
• Deliver security awareness training and promote secure practices.

Skills

Application security

Cloud computing

Software development

Threat modelling

DevSecOps

Education

Degree in a relevant discipline

Tools

GitLab

GitHub

Ansible

Fortify on Demand

SonarQube

Job description

Role Overview

We are seeking an experienced Application Security Officer to support cybersecurity risk management, application security reviews, security operations, and incident response activities across enterprise applications, infrastructure, and cloud environments.

The successful candidate will work closely with stakeholders, project teams, and technology teams to identify, assess, and remediate cybersecurity risks while promoting secure development practices and cybersecurity awareness.

Responsibilities

• Review system architecture, data flows, interfaces, APIs, internet-facing entry points, and existing security controls to identify potential security risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure, and cloud services.
• Develop threat models and threat profiles for application projects to identify, quantify, and remediate application security risks.
• Review remediation plans and supporting evidence to verify that identified security risks have been adequately addressed.
• Track security vulnerabilities and ensure timely remediation, patching, and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorized access, and cloud security incidents.
• Perform cybersecurity incident response and management activities, including incident triage, investigation, containment, remediation, recovery, and post-incident review.
• Conduct security awareness training sessions to promote cybersecurity awareness and security best practices.

Requirements

Experience & Technical Skills

• At least 5 years of combined work experience in software development, application security, and cloud computing environments (e.g., AWS).
• Good understanding of mobile and web application architectures, including APIs and related technologies and protocols such as REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Familiarity with Agile development methodologies, CI/CD, and DevSecOps practices, including tools such as GitLab, GitHub, and Ansible, as well as the integration of automated security testing into CI/CD pipelines.
• Experience using SAST code scanning tools such as Fortify-on-Demand, SonarQube, or equivalent solutions.
• Experience in threat modelling and developing threat profiles for application projects is preferred.

Soft Skills

• Good verbal and written communication skills.
• Strong collaboration skills and experience engaging with various stakeholders.
• Strong analytical, problem-solving, and troubleshooting abilities.
• Ability to work independently and effectively manage assigned responsibilities.

Education

• Degree in a relevant discipline or an equivalent qualification.

Preferred Qualifications

• Relevant professional certifications such as CISSP, OSCP, CCSP, CRISC, AWS Security Certification, or equivalent.
• Experience working with Government Commercial Cloud (GCC) environments is preferred.