Principal Cyber Security Architect (Application Security)

Dyson; Singapore; Presencial; SGD 180.000 - 260.000; Jornada completa

Descripción de la vacante

Dyson is seeking a Principal Cyber Security Architect for Application Security to lead security across Dyson's digital application landscape, including eCommerce, mobile apps and APIs. You will define reusable security architectures, embed security into the SDLC and establish a scalable DevSecOps capability with strong governance.

You will collaborate with engineering and product teams to deliver secure, measurable outcomes and guide security testing, risk assessments and threat modelling across

Formación

• Extensive experience in application security and security architecture.
• Strong knowledge of secure SDLC for web, mobile, API and cloud-native services.
• Hands-on experience with SAST, DAST and security test automation.
• Threat modelling and risk assessment skills for complex landscapes.
• Ability to influence across senior stakeholders and engineering teams.

Responsabilidades

• Set the application security and DevSecOps architecture direction.
• Provide authoritative security advice across web, mobile, API, microservices, serverless and cloud-native.
• Lead security architecture reviews and risk assessments from discovery through operation.
• Facilitate threat modelling and translate threats into engineering requirements.
• Define the DevSecOps control framework and reference pipeline.
• Guide security testing capabilities and vulnerability remediation.
• Strengthen software supply-chain security and SBOM governance.
• Partner with engineering enablement to create secure-by-default patterns.
• Develop security metrics and governance for ongoing improvement.
• Act as a trusted partner to Cyber Security, Digital, Engineering and Technology stakeholders.

Conocimientos

Application security

Security architecture

DevSecOps

Threat modelling

OWASP Top 10

SAST/DAST

Cloud security

Kubernetes

API security

Test automation

Educación

ISC2 CSSLP

CISSP

GIAC Secure Software

Herramientas

SAST tools

DAST tools

SBOM tooling

IaC scanning

Container security tools

Descripción del empleo

Principal Cyber Security Architect (Application Security)

Summary

Salary : Competitive Job Family : Cyber Security Location : Singapore - Technology Centre

About us

At Dyson, we are not just creating innovative, technology-enabled products; we are also breaking new ground in cybersecurity. Our products are becoming more advanced and interconnected, which means we face a constantly evolving cyber threat landscape. This requires a highly skilled candidate to join our team, with a passion for staying ahead of emerging threats and keeping our products secure.

We take a proactive approach to cybersecurity. We do not wait for threats to emerge; we anticipate them and respond with innovative solutions. This means that at Dyson, you will have the opportunity to work with innovative technologies, like artificial intelligence and machine learning, to protect our products and customers.

You will be part of a team of cybersecurity experts, utilizing the latest tools and technologies to identify and respond to threats in real-time. You will work closely with our engineering and product teams to ensure that security is integrated into every aspect of our business.

Join our team at Dyson, and you will be at the forefront of cybersecurity, working on some of the most innovative and advanced products in the industry. You will have the opportunity to develop your skills and knowledge, collaborating with a talented team of experts to ensure we are always secure. If you are passionate about cybersecurity and looking for an exciting and challenging role, Dyson is the place for you.

About the role

As Principal Cybersecurity Architect for Application Security and DevSecOps, you will be the senior architecture authority for security across Dyson's digital application landscape, including eCommerce, customer and ownership experiences, mobile applications, APIs and supporting cloud-native services.

You will define reusable security architectures, patterns and guardrails, and help establish a scalable DevSecOps capability that embeds proportionate security controls throughout the software development lifecycle. You will work with engineering teams to make secure delivery repeatable, measurable and developer-friendly, while retaining clear risk ownership and governance.

What you will do

• Set the application security and DevSecOps architecture direction, translating enterprise risk appetite and security policy into practical target architectures, principles, standards, patterns and control objectives.
• Provide authoritative security advice across web, mobile, API, microservices, serverless and cloud-native architectures, balancing security, resilience, customer experience, delivery speed and cost.
• Lead security architecture reviews and risk assessments from discovery through design, build, release and operation. Record design decisions, material risks, required controls, exceptions and residual risk in an audit-defensible manner.
• Facilitate threat modelling using fit-for-purpose techniques such as STRIDE, attack trees, abuse cases and data-flow analysis. Ensure identified threats are translated into owned engineering requirements and verified mitigations.
• Design and govern reusable security patterns for identity and access, session management, API protection, secrets, encryption, key and certificate use, tenant isolation, input and output handling, logging, monitoring and secure failure modes.
• Define the DevSecOps control framework and reference pipeline, including policy-as-code, security quality gates, risk-based thresholds, exception workflows, evidence capture and feedback loops across CI/CD.
• Guide the integration and effective use of security testing capabilities, including SAST, DAST, software composition analysis, secrets scanning, infrastructure-as-code scanning, container and image scanning, API security testing, mobile testing and penetration testing.
• Strengthen software supply-chain security by defining expectations for dependency governance, software bills of materials, provenance and integrity, artifact signing, trusted build environments and third‑party component risk.
• Partner with engineering enablement and platform teams to create secure‑by‑default paved roads, templates and reusable controls that reduce friction and prevent recurring vulnerabilities.
• Establish vulnerability triage and remediation models that include severity, exploitability, business context, ownership, service‑level expectations, risk acceptance and verification of closure.
• Develop application security metrics and capability measures covering control coverage, effectiveness, engineering adoption, security debt, remediation performance and recurring defect patterns. Use evidence to prioritise improvement.
• Build capability through security champions, role‑based training, coaching, communities of practice and practical guidance for architects, developers, testers, product managers and platform engineers.
• Act as a trusted partner to Cyber Security and Risk, Digital, Engineering and Technology stakeholders. Provide technical leadership to virtual teams and suppliers, assure delivery quality and support effective transition into operations.
• Support the investigation and resolution of significant application security incidents, vulnerabilities and control failures, converting lessons learned into improved patterns, guardrails and engineering practices.

About you

You are an experienced application security architect who can operate at both strategic and technical depth. You can define a target state, influence senior stakeholders and work directly with engineering teams to make security controls effective in real delivery environments.

To succeed in this role you should,

• Extensive experience in application security, security architecture or secure software engineering, with demonstrable ownership of complex, enterprise-scale outcomes.
• Strong knowledge of secure software design and the software development lifecycle across web, mobile, API, microservices and cloud-native services.
• Practical experience designing or maturing DevSecOps capabilities and integrating security controls into modern CI/CD platforms and developer workflows.
• Deep understanding of common application and API threats, including the OWASP Top 10 and OWASP API Security Top 10, and the ability to translate weaknesses into design and engineering controls.
• Hands‑on understanding of SAST, DAST, software composition analysis, secrets scanning, infrastructure‑as‑code scanning, container and image scanning and security test automation, including tuning, coverage, false‑positive management and quality gates.
• Strong threat‑modelling and security‑risk‑assessment skills, including the ability to model trust boundaries, data flows, abuse paths and compensating controls.
• Experience with identity protocols and application security controls, including OAuth 2.0, OpenID Connect, SAML, token handling, authorisation design, session security, secrets and cryptographic key management.
• Knowledge of cloud and container security concepts across at least one major cloud platform, with sufficient breadth to assess Kubernetes, serverless, API gateways, service‑to‑service communication and infrastructure as code.
• Working knowledge of software supply‑chain controls, including dependency governance, SBOMs, artifact integrity, signing, provenance, build‑pipeline security and third‑party component risk.
• Experience defining architecture documentation, security requirements, patterns, technical standards, low‑level designs and risk decisions that are clear to both engineers and governance stakeholders.
• Strong communication, facilitation and influencing skills, with the ability to explain technical risk, trade‑offs and required decisions to engineering teams and senior leaders.
• Ability to work independently, lead through influence and coordinate multidisciplinary internal teams and external partners.
• Experienceestablishingsecurity‑champion networks, developer securityeducationor product security communities of practice.
• Experience with web application and API protection services, including WAF policy design, bot management, rate limiting and carefully governed virtual patching, without treating perimeter controls as a substitute for remediation.
• Experience defining control evidence and metrics forregulated, high‑assurance or audit‑sensitive environments.
• Knowledge of mobile application security testing, secure mobiledesignand relevant OWASP mobile guidance.
• Relevant certifications such as ISC2 CSSLP, CISSP, GIAC secure software credentials or cloud security certifications.Certifications are valued as supporting evidence, not a substitute for demonstrated practical capability.

Dyson is an equal opportunity employer. We know that great minds don’t think alike, and it takes all kinds of minds to make our technology so unique. We welcome applications from all backgrounds and employment decisions are made without regard to race, colour, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other any other dimension of diversity.