Principal DevSecOps & App Security Architect

Dyson Institute; Singapore; On-site; SGD 180,000 - 240,000; Full time

Job summary

Dyson Institute in Singapore seeks a Principal Cybersecurity Architect for Application Security and DevSecOps to lead security across Dyson's digital landscape, including eCommerce, customer experiences, mobile apps, APIs and cloud services.

Define reusable security architectures and guardrails, build a scalable DevSecOps capability, and ensure secure delivery across engineering teams with clear risk ownership.

Qualifications

• Extensive experience in application security and security architecture.
• Strong knowledge of secure software development lifecycle across web, mobile, APIs, microservices and cloud-native services.
• Hands-on experience designing DevSecOps capabilities and integrating security into CI/CD workflows.
• Deep understanding of OWASP Top 10 and API Security Top 10 with actionable controls.
• Proficiency in SAST, DAST, software composition analysis and secrets management.
• Knowledge of cloud and container security across major cloud platforms.

Responsibilities

• Define and set application security and DevSecOps architecture direction.
• Provide security guidance across web, mobile, API, microservices and cloud-native architectures.
• Lead security architecture reviews and risk assessments from discovery to operation.
• Facilitate threat modelling using STRIDE and data-flow analysis.
• Define reusable security patterns and a DevSecOps control framework for pipelines.

Skills

Application security

Security architecture

DevSecOps

Threat modelling

OWASP Top 10

SAST/DAST

Cloud security

Kubernetes

Python

Communication skills

Education

ISC2 CSSLP

CISSP

GIAC certs

Tools

REST API

GraphQL

JSON

YAML

CI/CD

Job description

Dyson Institute in Singapore seeks a Principal Cybersecurity Architect for Application Security and DevSecOps to lead security across Dyson's digital landscape, including eCommerce, customer experiences, mobile apps, APIs and cloud services.

Define reusable security architectures and guardrails, build a scalable DevSecOps capability, and ensure secure delivery across engineering teams with clear risk ownership.