Principal Cyber Security Architect (Application Security)

Dyson Institute; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

Dyson Institute in Singapore seeks a Principal Cybersecurity Architect for Application Security and DevSecOps to lead security across Dyson's digital landscape, including eCommerce, customer experiences, mobile apps, APIs and cloud services.

Define reusable security architectures and guardrails, build a scalable DevSecOps capability, and ensure secure delivery across engineering teams with clear risk ownership.

Qualifications

• Extensive experience in application security and security architecture.
• Strong knowledge of secure software development lifecycle across web, mobile, APIs, microservices and cloud-native services.
• Hands-on experience designing DevSecOps capabilities and integrating security into CI/CD workflows.
• Deep understanding of OWASP Top 10 and API Security Top 10 with actionable controls.
• Proficiency in SAST, DAST, software composition analysis and secrets management.
• Knowledge of cloud and container security across major cloud platforms.

Responsibilities

• Define and set application security and DevSecOps architecture direction.
• Provide security guidance across web, mobile, API, microservices and cloud-native architectures.
• Lead security architecture reviews and risk assessments from discovery to operation.
• Facilitate threat modelling using STRIDE and data-flow analysis.
• Define reusable security patterns and a DevSecOps control framework for pipelines.

Skills

Application security

Security architecture

DevSecOps

Threat modelling

OWASP Top 10

SAST/DAST

Cloud security

Kubernetes

Python

Communication skills

Education

ISC2 CSSLP

CISSP

GIAC certs

Tools

REST API

GraphQL

JSON

YAML

CI/CD

Job description

About us

At Dyson, we are not just creating innovative, technology-enabled products; we are also breaking new ground in cybersecurity. Our products are becoming more advanced and interconnected, which means we face a constantly evolving cyber threat landscape. This requires a highly skilled candidate to join our team, with a passion for staying ahead of emerging threats and keeping our products secure. We take a proactive approach to cybersecurity. We do not wait for threats to emerge; we anticipate them and respond with innovative solutions. This means that at Dyson, you will have the opportunity to work with innovative technologies, like artificial intelligence and machine learning, to protect our products and customers. You will be part of a team of cybersecurity experts, utilizing the latest tools and technologies to identify and respond to threats in real-time. You will work closely with our engineering and product teams to ensure that security is integrated into every aspect of our business. Join our team at Dyson, and you will be at the forefront of cybersecurity, working on some of the most innovative and advanced products in the industry. You will have the opportunity to develop your skills and knowledge, collaborating with a talented team of experts to ensure we are always secure. If you are passionate about cybersecurity and looking for an exciting and challenging role, Dyson is the place for you.

About the role

As Principal Cybersecurity Architect for Application Security and DevSecOps, you will be the senior architecture authority for security across Dyson's digital application landscape, including eCommerce, customer and ownership experiences, mobile applications, APIs and supporting cloud-native services. You will define reusable security architectures, patterns and guardrails, and help establish a scalable DevSecOps capability that embeds proportionate security controls throughout the software development lifecycle. You will work with engineering teams to make secure delivery repeatable, measurable and developer-friendly, while retaining clear risk ownership and governance.

What you will do

• Set the application security and DevSecOps architecture direction, translating enterprise risk appetite and security policy into practical target architectures, principles, standards, patterns and control objectives.
• Provide authoritative security advice across web, mobile, API, microservices, serverless and cloud-native architectures, balancing security, resilience, customer experience, delivery speed and cost.
• Lead security architecture reviews and risk assessments from discovery through design, build, release and operation.
• Record design decisions, material risks, required controls, exceptions and residual risk in an audit-defensible manner.
• Facilitate threat modelling using fit‑for‑purpose techniques such as STRIDE, attack trees, abuse cases and data‑flow analysis.
• Ensure identified threats are translated into owned engineering requirements and verified mitigations.
• Design and govern reusable security patterns for identity and access, session management, API protection, secrets, encryption, key and certificate use, tenant isolation, input and output handling, logging, monitoring and secure failure modes.
• Define the DevSecOps control framework and reference pipeline, including policy‑as‑code, security quality gates, risk‑based thresholds, exception workflows, evidence capture and feedback loops across CI/CD.
• Guide the integration and effective use of security testing capabilities, including SAST, DAST, software composition analysis, secrets scanning, infrastructure‑as‑code scanning, container and image scanning, API security testing, mobile testing and penetration testing.
• Strengthen software supply‑chain security by defining expectations for dependency governance, software bills of materials, provenance and integrity, artifact signing, trusted build environments and third‑party component risk.
• Partner with engineering enablement and platform teams to create secure‑by‑default paved roads, templates and reusable controls that reduce friction and prevent recurring vulnerabilities.
• Establish vulnerability triage and remediation models that include severity, exploitability, business context, ownership, service‑level expectations, risk acceptance and verification of closure.
• Develop application security metrics and capability measures covering control coverage, effectiveness, engineering adoption, security debt, remediation performance and recurring defect patterns.
• Use evidence to prioritise improvement.
• Build capability through security champions, role‑based training, coaching, communities of practice and practical guidance for architects, developers, testers, product managers and platform engineers.
• Act as a trusted partner to Cyber Security and Risk, Digital, Engineering and Technology stakeholders. Provide technical leadership to virtual teams and suppliers, assure delivery quality and support effective transition into operations.
• Support the investigation and resolution of significant application security incidents, vulnerabilities and control failures, converting lessons learned into improved patterns, guardrails and engineering practices.

About you

• Extensive experience in application security, security architecture or secure software engineering, with demonstrable ownership of complex, enterprise‑scale outcomes.
• Strong knowledge of secure software design and the software development lifecycle across web, mobile, API, microservices and cloud‑native services.
• Practical experience designing or maturing DevSecOps capabilities and integrating security controls into modern CI/CD platforms and developer workflows.
• Deep understanding of common application and API threats, including the OWASP Top 10 and OWASP API Security Top 10, and the ability to translate weaknesses into design and engineering controls.
• Hands‑on understanding of SAST, DAST, software composition analysis, secrets scanning, infrastructure‑as‑code scanning, container and image scanning and security test automation, including tuning, coverage, false‑positive management and quality gates.
• Strong threat‑modelling and security‑risk‑assessment skills, including the ability to model trust boundaries, data flows, abuse paths and compensating controls.
• Experience with identity protocols and application security controls, including OAuth 2.0, OpenID Connect, SAML, token handling, authorisation design, session security, secrets and cryptographic key management.
• Knowledge of cloud and container security concepts across at least one major cloud platform, with sufficient breadth to assess Kubernetes, serverless, API gateways, service‑to‑service communication and infrastructure as code.
• Working knowledge of software supply‑chain controls, including dependency governance, SBOMs, artifact integrity, signing, provenance, build‑pipeline security and third‑party component risk.
• Ability to read and challenge code, configuration and pipeline definitions.
• Proficiency in at least one relevant language such as Python, Java, JavaScript or TypeScript, C# or Go, plus practical use of REST or GraphQL APIs, JSON, YAML and scripting for automation.
• Experience defining architecture documentation, security requirements, patterns, technical standards, low‑level designs and risk decisions that are clear to both engineers and governance stakeholders.
• Strong communication, facilitation and influencing skills, with the ability to explain technical risk, trade‑offs and required decisions to engineering teams and senior leaders.
• Ability to work independently, lead through influence and coordinate multidisciplinary internal teams and external partners.
• Experience establishing security‑champion networks, developer security education or product security communities of practice.
• Experience with web application and API protection services, including WAF policy design, bot management, rate limiting and carefully governed virtual patching, without treating perimeter controls as a substitute for remediation.
• Experience defining control evidence and metrics for regulated, high‑assurance or audit‑sensitive environments.
• Knowledge of mobile application security testing, secure mobile design and relevant OWASP mobile guidance.
• Relevant certifications such as ISC2 CSSLP, CISSP, GIAC secure software credentials or cloud security certifications. Certifications are valued as supporting evidence, not a substitute for demonstrated practical capability.

Dyson is an equal opportunity employer. We know that great minds don’t think alike, and it takes all kinds of minds to make our technology so unique. We welcome applications from all backgrounds and employment decisions are made without regard to race, colour, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other any other dimension of diversity. At Dyson we are focused on solving the problems that others have ignored; solving them first using our technology and ingenuity.

In order to achieve this we need to pioneer technologies that are different and authentic. This is the core of what we do and who we are. We must strive to create the future, every single day by developing new things, different things, things that go against the grain with a diverse and global team of ingenious minds. Dyson employs 14,000 people and is present in more than 80 countries. And while we are growing fast we want Dyson to remain a start-up in spirit with the freedom of experimentation and learning, constantly reinventing our products as well as reinventing how we work, how we sell and how we support our owners. At the same time we are working through the James Dyson Foundation, James Dyson Award and Dyson Institute to inspire future engineers and pioneering a new approach to engineering education. Underlining everything we do in this diverse environment is the need to always show respect, supporting each other as one team to overcome whatever challenges we encounter. We drive empowerment, development and equality in an inclusive environment for our people around the world. The future doesn’t just happen, we look to make it happen, to achieve leaps through pioneering new ideas.