M04 - IT Security Engineer

FPT Asia Pacific; Singapore; On-site; SGD 80,000 - 120,000; Full time

Job summary

FPT Asia Pacific is seeking an experienced IT Security Officer to support application security, cloud security, vulnerability management, and incident response. You will assess risks, review architectures, identify vulnerabilities, and ensure compliance with cybersecurity standards.

The role requires 5+ years across software development, application security, and cloud environments (AWS). Strong knowledge of OWASP ASVS and SAST tools is preferred, with CI/CD and DevSecOps experience.

Qualifications

• Degree in Information Technology, Computer Science, Cybersecurity or related discipline.
• Minimum 5 years of combined experience in software development, application security and cloud computing environments such as AWS.
• Strong knowledge of application security principles, OWASP Top 10 and ASVS.
• Familiarity with Agile, CI/CD and DevSecOps practices including GitLab, GitHub, and Ansible.
• Experience with SAST tools like Fortify on Demand or SonarQube.

Responsibilities

• Review system architectures, data flows, interfaces and APIs to identify security risks.
• Conduct cybersecurity risk assessments for systems, apps, infra and cloud services.
• Perform threat modelling and develop threat profiles for risk mitigation.
• Review remediation plans and evidence to address security risks.
• Track vulnerabilities and ensure timely remediation, patching and closure.
• Monitor cybersecurity alerts and incidents including malware, data breaches and access issues.
• Manage cybersecurity incidents from triage to post-incident reviews.
• Support automated security testing in CI/CD pipelines.
• Conduct security awareness training sessions for best practices.
• Collaborate with teams to strengthen security controls.

Skills

Security governance

Threat modelling

CI/CD/DevSecOps

SAST tools

Cloud security (AWS)

OWASP ASVS

REST/SOAP/SSL/TLS

Communication

Analytical thinking

Independent work

Education

Degree in Information Technology, Computer Science, Cybersecurity

Tools

GitLab

GitHub

Ansible

Fortify on Demand

SonarQube

Job description

Job Overview

We are seeking an experienced IT Security Officer (ITSO) to support application security, cybersecurity risk management, vulnerability management, cloud security, and incident response. The role involves assessing security risks, reviewing system architectures, identifying vulnerabilities, and ensuring compliance with cybersecurity standards and best practices.

Key Responsibilities

• Review system architectures, data flows, interfaces, APIs, internet-facing entry points, and security controls to identify potential security risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure, and cloud services.
• Perform threat modelling and develop threat profiles to identify, assess, and mitigate application security risks.
• Review remediation plans and supporting evidence to ensure identified security risks are adequately addressed.
• Track security vulnerabilities and ensure timely remediation, patching, and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorised access, and cloud security incidents.
• Manage cybersecurity incidents, including triage, investigation, containment, remediation, recovery, and post-incident reviews.
• Support the integration of automated security testing into CI/CD pipelines.
• Conduct security awareness training sessions to promote cybersecurity best practices.
• Collaborate with technical teams, project stakeholders, and relevant parties to address security concerns and strengthen security controls.

Requirements

• Degree in Information Technology, Computer Science, Cybersecurity, or a related discipline, or an equivalent qualification.
• Minimum 5 years of combined experience in software development, application security, and cloud computing environments such as AWS.
• Good understanding of mobile and web application architectures, APIs, and related technologies and protocols, including REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles, industry best practices, OWASP Top 10, and OWASP Application Security Verification Standard (ASVS).
• Familiarity with Agile development, CI/CD, and DevSecOps practices, including tools such as GitLab, GitHub, and Ansible.
• Experience using Static Application Security Testing (SAST) tools such as Fortify on Demand, SonarQube, or equivalent solutions.
• Good understanding of cybersecurity risk assessment, vulnerability management, and incident response processes.
• Strong analytical, problem-solving, and troubleshooting skills.
• Good written and verbal communication skills, with the ability to collaborate effectively with various stakeholders.
• Ability to work independently and manage security-related activities effectively.

Preferred Qualifications

• Experience in threat modelling and application security risk assessment.
• Experience working with Government Commercial Cloud (GCC).
• Relevant professional certifications such as CISSP, OSCP, CCSP, CRISC, AWS Security Certification, or equivalent.