Principal Application Security Engineer (Contract Role)

QUESS SINGAPORE; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

QUESS SINGAPORE is seeking a senior Application Security Lead to drive secure coding practices across Java and Go services, perform code reviews, threat modelling, and secure SDLC integration.

You will mentor engineers, define security standards, build tooling, and assess risks in web and mobile/backend apps, communicating risks to technical and business stakeholders.

Qualifications

• Bachelor's degree or equivalent practical experience.
• At least 6 years of professional application security experience.
• Hands-on Java and/or Go with Spring or Gin.
• Deep OWASP Top 10 and business logic vulnerabilities knowledge.
• Experience threat modelling and secure SDLC.
• Experience developing or customizing code analysis tooling.
• Demonstrated vulnerability research track record (CVE, bug bounty).
• Ability to advocate security standards across teams.
• Strong English communication.

Responsibilities

• Lead application security reviews and provide remediation guidance.
• Assess architecture, data flows, and identify risks.
• Define secure development standards and integrate SDL checks.
• Build or tune analysis tooling for early vulnerability detection.
• Perform threat modelling, security reviews, and testing.
• Investigate emerging vulnerabilities and guide remediation.
• Review security controls and SOPs for sensitive systems.
• Prioritize findings with engineering teams and verify fixes.
• Provide mentoring on secure design and coding practices.

Skills

Java

Go

Threat modelling

Secure SDLC

Security reviews

Documentation

Mentoring

Vulnerability research

Education

Bachelor’s degree or equivalent

Tools

Code analysis tooling

Job description

Key Responsibilities

• Lead application security reviews, including manual code audits of Java and Go applications and supporting components in other languages, and provide clear, practical remediation guidance.
• Assess application architecture, business logic and data flows to identify security risks, and recommend proportionate controls.
• Define secure development standards and integrate security checks, including static analysis, into the software development lifecycle (SDL).
• Build, extend or tune static and dynamic analysis tooling so that common vulnerability classes are found early and at scale.
• Perform threat modelling, secure architecture reviews and penetration testing of web, backend and mobile or desktop applications (including iOS and macOS).
• Investigate and validate relevant emerging vulnerabilities, assess their impact on our systems, and guide remediation.
• Review and improve operational security controls for sensitive systems, such as authorisation, segregation of duties, approval workflows and standard operating procedures (SOPs).
• Work with engineering teams to prioritise security findings and verify that fixes address the underlying risks.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Job Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Security or a related field, or equivalent practical experience.
• At least 6 years of professional application security experience, including technical ownership of security initiatives across engineering teams.
• Strong Java and/or Go skills, with hands‑on experience manually auditing applications built with frameworks such as Spring or Gin.
• Deep understanding of common application vulnerabilities, including those in the OWASP Top 10, and of business logic flaws, access control weaknesses and authentication or session‑handling issues.
• Practical experience in threat modelling, secure architecture reviews, penetration testing and implementing a secure software development lifecycle.
• Experience developing or customising code analysis tooling (for example, rules, bytecode analysis or control‑flow analysis) to detect vulnerabilities.
• A demonstrated vulnerability research track record, such as CVE disclosures, vendor security acknowledgements or bug bounty contributions.
• Ability to evaluate security trade‑offs, establish standards and guide remediation across complex applications.
• Strong communication and documentation skills in English, with the ability to explain risks to technical and business stakeholders.

Advantageous

• Reverse engineering experience on iOS, macOS or Android applications, including analysis of authentication mechanisms and communication protocols.
• Experience in vulnerability research on operating system components or frameworks.
• Experience designing or reviewing encryption, data protection or Trusted Execution Environment (TEE) solutions.
• Experience using automation or AI‑assisted tools to support security reviews, with independent validation of findings.
• Experience working in a regulated financial services environment.