Python Developer-Application Security

Hi5 Consult; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

Hi5 Consult is seeking a seasoned Python-focused security engineer to design, develop, and maintain secure applications in Singapore. You will perform security assessments, code reviews, and testing across Python-based systems, and integrate security into CI/CD processes.

The role requires deep OWASP Top 10 knowledge, REST API security expertise, and familiarity with authentication standards (OAuth 2.0, OpenID Connect, JWT). Collaboration with DevOps, QA, and security teams is essential.

Qualifications

• Proficiency in Python programming and scripting.
• Experience with Python frameworks such as Django, Flask, or FastAPI.
• Knowledge of OWASP Top 10 vulnerabilities and mitigation techniques.
• Experience with REST API security and secure web development.
• Understanding authentication protocols (OAuth 2.0, OpenID Connect, JWT).
• Familiarity with CI/CD security practices.

Responsibilities

• Design, develop, and maintain secure Python applications.
• Identify and remediate vulnerabilities in Python apps.
• Conduct security assessments, code reviews, and testing.
• Integrate security checks into CI/CD pipelines and workflows.
• Develop Python scripts for security testing and reporting.
• Collaborate with DevOps, QA, and security teams.

Skills

Python programming

Django/Flask/FastAPI

OWASP Top 10

REST API security

OAuth 2.0/OpenID Connect/JWT

SQLi/XSS/CSRF/SSRF

CI/CD security

Git/Linux

Encryption/hash/secrets

Tools

SonarQube

Bandit

Semgrep

Snyk

Burp Suite

OWASP ZAP

Job description

• Design, develop, and maintain secure applications using Python.
• Implement secure coding practices to prevent common application vulnerabilities.
• Identify, analyze, and remediate security vulnerabilities in Python-based applications.
• Perform application security assessments, code reviews, and security testing.
• Integrate security checks into CI/CD pipelines and development workflows.
• Develop Python scripts and automation tools for security testing, vulnerability analysis, and reporting.
• Identify and address vulnerabilities related to OWASP Top 10, including SQL injection, cross-site scripting (XSS), broken access control, and security misconfiguration.
• Implement secure authentication, authorization, session management, and access controls.
• Work with security teams to perform Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA).
• Assess third-party libraries and dependencies for known security vulnerabilities.
• Implement secure API development practices, including input validation, rate limiting, and proper error handling.
• Support vulnerability remediation, security audits, and compliance requirements.
• Collaborate with developers, DevOps engineers, QA teams, and security professionals to improve application security.

Required Technical Skills

• Strong proficiency in Python programming and scripting.
• Experience with Python frameworks such as Django, Flask, or FastAPI.
• Good understanding of application security principles and secure software development practices.
• Knowledge of OWASP Top 10 vulnerabilities and mitigation techniques.
• Experience with REST API security and secure web application development.
• Understanding of authentication protocols such as OAuth 2.0, OpenID Connect, and JWT.
• Knowledge of SQL injection, XSS, CSRF, SSRF, insecure deserialization, and broken access control.
• Experience with application security testing and vulnerability remediation.
• Familiarity with Git, Linux, and CI/CD pipelines.
• Knowledge of encryption, hashing, secrets management, and secure configuration.

Preferred Skills

• Experience with security tools such as SonarQube, Bandit, Semgrep, Snyk, Burp Suite, or OWASP ZAP.
• Familiarity with SAST, DAST, and SCA tools.
• Experience automating security testing using Python.
• Knowledge of Docker, Kubernetes, and cloud security fundamentals.
• Familiarity with AWS, Azure, or GCP security services.
• Understanding of threat modeling and security risk assessment.
• Knowledge of DevSecOps practices and security integration into CI/CD pipelines.
• Familiarity with compliance standards such as ISO 27001, SOC 2, or PCI DSS.