Principal Application Security Engineer (Contract Role)

QUESSCORP SINGAPORE PTE. LTD.; Singapore; Sur place; SGD 120 000 - 180 000; Plein temps

Résumé du poste

QUESSCORP SINGAPORE PTE. LTD. in Singapore seeks a senior application security engineer to lead security reviews, manually audit Java and Go applications, and embed secure development practices across teams.

You will assess architecture, data flows and business logic to identify risks and define proportionate controls. You will also build or tune static/dynamic analysis tooling, perform threat modelling and penetration testing for web, backend and mobile/desktop apps, and mentor engineers on

Qualifications

• Bachelor's degree in Computer Science, Engineering, Information Security or a related field.
• At least 6 years of professional application security experience across engineering teams.
• Strong Java and/or Go skills, with hands-on auditing experience (Spring/Gin).
• Deep understanding of OWASP Top 10 and business logic, access control weaknesses and authentication/session handling issues.
• Practical experience in threat modelling, secure architecture reviews, penetration testing and implementing a secure SDLC.
• Experience developing or customizing code analysis tooling (rules, bytecode analysis or control-flow analysis).
• Demonstrated vulnerability research track record (e.g., CVEs, bug bounty contributions).
• Ability to evaluate security trade-offs and guide remediation across complex applications.
• Strong communication and documentation skills in English.

Responsabilités

• Lead application security reviews, including manual code audits of Java and Go applications and supporting components in other languages, and provide clear, practical remediation guidance.
• Assess application architecture, business logic and data flows to identify security risks, and recommend proportionate controls.
• Define secure development standards and integrate security checks, including static analysis, into the software development lifecycle (SDL).
• Build, extend or tune static and dynamic analysis tooling so that common vulnerability classes are found early and at scale.
• Perform threat modelling, secure architecture reviews and penetration testing of web, backend and mobile or desktop applications (including iOS and macOS).
• Investigate and validate relevant emerging vulnerabilities, assess their impact on our systems, and guide remediation.
• Review and improve operational security controls for sensitive systems, such as authorisation, segregation of duties, approval workflows and SOPs.
• Work with engineering teams to prioritise security findings and verify that fixes address the underlying risks.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Connaissances

Java

Go

Threat modelling

Secure SDLC

Code auditing

Spring

Gin

OWASP Top 10

Mentoring engineers

Communication

Formation

Bachelor's degree in Computer Science/Engineering/Information Security or related field

Outils

Static analysis tooling

Bytecode analysis

Control-flow analysis

Penetration testing tooling

Description du poste

Key Responsibilities

• Lead application security reviews, including manual code audits of Java and Go applications and supporting components in other languages, and provide clear, practical remediation guidance.
• Assess application architecture, business logic and data flows to identify security risks, and recommend proportionate controls.
• Define secure development standards and integrate security checks, including static analysis, into the software development lifecycle (SDL).
• Build, extend or tune static and dynamic analysis tooling so that common vulnerability classes are found early and at scale.
• Perform threat modelling, secure architecture reviews and penetration testing of web, backend and mobile or desktop applications (including iOS and macOS).
• Investigate and validate relevant emerging vulnerabilities, assess their impact on our systems, and guide remediation.
• Review and improve operational security controls for sensitive systems, such as authorisation, segregation of duties, approval workflows and standard operating procedures (SOPs).
• Work with engineering teams to prioritise security findings and verify that fixes address the underlying risks.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Job Requirements

• Bachelor's degree in Computer Science, Engineering, Information Security or a related field, or equivalent practical experience.
• At least 6 years of professional application security experience, including technical ownership of security initiatives across engineering teams.
• Strong Java and/or Go skills, with hands‑on experience manually auditing applications built with frameworks such as Spring or Gin.
• Deep understanding of common application vulnerabilities, including those in the OWASP Top 10, and of business logic flaws, access control weaknesses and authentication or session‑handling issues.
• Practical experience in threat modelling, secure architecture reviews, penetration testing and implementing a secure software development lifecycle.
• Experience developing or customising code analysis tooling (for example, rules, bytecode analysis or control‑flow analysis) to detect vulnerabilities.
• A demonstrated vulnerability research track record, such as CVE disclosures, vendor security acknowledgements or bug bounty contributions.
• Ability to evaluate security trade‑offs, establish standards and guide remediation across complex applications.
• Strong communication and documentation skills in English, with the ability to explain risks to technical and business stakeholders.

Advantageous

• Reverse engineering experience on iOS, macOS or Android applications, including analysis of authentication mechanisms and communication protocols.
• Experience in vulnerability research on operating system components or frameworks.
• Experience designing or reviewing encryption, data protection or Trusted Execution Environment (TEE) solutions.
• Experience using automation or AI‑assisted tools to support security reviews, with independent validation of findings.
• Experience working in a regulated financial services environment.

Disclaimer

The company is committed to ensuring theprivacy and security of your information. By submitting this form, youconsent to the collection, processing, and retention of the information youprovide. The data collected (which may include your contact details,educational background, work experience and skills) will be used solely for thepurpose of evaluating your qualifications for the position you're applying for.Your data will be stored securely and retained for the duration necessary tofulfill our hiring process. If you are not selected for the position, your datawill be kept on file for a limited period in case future opportunities arise.You have the right to access, correct, or delete your data at any time bycontacting us at

Additional Information

"This is inpartnership with the Employment and Employability Institute Pte Ltd ("e2i"). e2i is theempowering network for workers and employers seeking employment andemployability solutions. e2i serves as a bridge between workers andemployers, connecting with workers to offer job security through job-matching,career guidance and skills upgrading services, and partnering employers toaddress their manpower needs through recruitment, training, and job redesign solutions.e2i is a tripartite initiative of the National Trades Union Congress setup to support nation-wide manpower and skills upgrading initiatives. Byapplying for this role, you consent to Quesscorp Singapore's PDPA and e2i'sPDPA. By submitting your application for this position, youconsent to the collection, use, and disclosure of your personal data byQuesscorp and its recruitment partners, including Employment andEmployability Institute Pte Ltd, for the purpose of i) employment facilitationand ii) data and statistical analysis. You may find out more informationon the