Principal Application Security Engineer (Contract Role)

QUESSCORP SOLUTIONS PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

QUESSCORP SOLUTIONS PTE. LTD. seeks an experienced Application Security Lead to drive security reviews across Java and Go applications, including manual code audits and remediation guidance. You will assess architecture and data flows, define secure SDLC standards, and build tooling to detect vulnerabilities at scale.

The role requires hands-on experience with OWASP Top 10, threat modelling, pen testing, and secure coding guidance. Strong English communication and leadership are essential.

Qualifications

• Bachelor's degree in Computer Science, Engineering, Information Security or related field, or equivalent practical experience.
• 6+ years of professional application security experience with technical ownership across engineering teams.
• Strong Java and/or Go skills with hands-on auditing experience (Spring/Gin).
• Deep understanding of OWASP Top 10 and business logic, access control and authentication issues.
• Experience in threat modelling, secure architecture reviews, penetration testing and SDL implementation.
• Experience developing or customizing code analysis tooling to detect vulnerabilities.
• Demonstrated vulnerability research track record (CVE disclosures, bug bounties).
• Ability to evaluate security trade-offs, set standards and guide remediation across complex apps.
• Strong English communication and documentation skills.

Responsibilities

• Lead application security reviews, including manual code audits of Java and Go apps and provide remediation guidance.
• Assess architecture, logic and data flows to identify risks and design appropriate controls.
• Define secure development standards and integrate security checks into SDL.
• Build or tune tooling to catch common vulnerabilities early and at scale.
• Perform threat modelling, secure architecture reviews, and pen tests of web, backend and mobile/desktop apps.
• Investigate emerging vulnerabilities and guide remediation impact.
• Review and improve security controls for sensitive systems and SOPs.
• Collaborate with engineering teams to prioritize findings and verify fixes address root causes.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Skills

Java

Go

Spring

Gin

Security reviews

Threat modelling

Penetration testing

Code analysis tooling

Communication skills

Documentation

Education

Bachelor's degree in Computer Science, Engineering, Information Security or a related field, or equivalent practical experience

Tools

Static analysis tooling

Dynamic analysis tooling

Bytecode analysis

Control-flow analysis

Job description

Key Responsibilities

• Lead application security reviews, including manual code audits of Java and Go applications and supporting components in other languages, and provide clear, practical remediation guidance.
• Assess application architecture, business logic and data flows to identify security risks, and recommend proportionate controls.
• Define secure development standards and integrate security checks, including static analysis, into the software development lifecycle (SDL).
• Build, extend or tune static and dynamic analysis tooling so that common vulnerability classes are found early and at scale.
• Perform threat modelling, secure architecture reviews and penetration testing of web, backend and mobile or desktop applications (including iOS and macOS).
• Investigate and validate relevant emerging vulnerabilities, assess their impact on our systems, and guide remediation.
• Review and improve operational security controls for sensitive systems, such as authorisation, segregation of duties, approval workflows and standard operating procedures (SOPs).
• Work with engineering teams to prioritise security findings and verify that fixes address the underlying risks.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Job Requirements

• Bachelor’s degree in Computer Science, Engineering, Information Security or a related field, or equivalent practical experience.
• At least 6 years of professional application security experience, including technical ownership of security initiatives across engineering teams.
• Strong Java and/or Go skills, with hands-on experience manually auditing applications built with frameworks such as Spring or Gin.
• Deep understanding of common application vulnerabilities, including those in the OWASP Top 10, and of business logic flaws, access control weaknesses and authentication or session-handling issues.
• Practical experience in threat modelling, secure architecture reviews, penetration testing and implementing a secure software development lifecycle.
• Experience developing or customising code analysis tooling (for example, rules, bytecode analysis or control-flow analysis) to detect vulnerabilities.
• A demonstrated vulnerability research track record, such as CVE disclosures, vendor security acknowledgements or bug bounty contributions.
• Ability to evaluate security trade-offs, establish standards and guide remediation across complex applications.
• Strong communication and documentation skills in English, with the ability to explain risks to technical and business stakeholders.

Advantageous

• Reverse engineering experience on iOS, macOS or Android applications, including analysis of authentication mechanisms and communication protocols.
• Experience in vulnerability research on operating system components or frameworks.
• Experience designing or reviewing encryption, data protection or Trusted Execution Environment (TEE) solutions.
• Experience using automation or AI-assisted tools to support security reviews, with independent validation of findings.
• Experience working in a regulated financial services environment.