Senior Application Security Engineer

OSL; Singapore; On-site; SGD 70,000 - 150,000; Full time

Job summary

OSL is seeking an experienced AppSec professional to perform security reviews, testing, and remediation across Web apps, APIs, and Web3 components. You will contribute to the SDL and secure CI/CD processes, and handle incident response to protect critical assets.

The role requires familiarity with OWASP Top 10, Web3 threats, and automation scripting to streamline security testing and reporting.

Qualifications

• 2+ years in AppSec or penetration testing.
• Solid knowledge of OWASP Top 10 and related web/API vulnerabilities.
• Experience with Web3 threats and smart contract/security testing.
• Ability to script in Python or Go for automation.

Responsibilities

• Code Audit & Penetration Testing of Web applications, APIs, and Web3 infrastructure (Smart Contracts, DApps, Wallets).
• SDL & DevSecOps: Drive the Security Development Lifecycle by integrating SAST/DAST automation tools into CI/CD pipelines.
• Incident Response: Handle application-level security incidents, conduct root-cause analysis, and track vulnerability remediation.
• Security Architecture Review: Participate in product design reviews to identify architectural/logical flaws and provide security hardening solutions.

Skills

AppSec / Penetration Testing

OWASP Top 10

Web3 / Smart Contracts Auditing

Scripting / Automation (Python/Go)

Tools

Burp Suite

Slither

Mythril

Checkmarx

Job description

Key Responsibilities:

• Code Audit & Penetration Testing: Conduct security code reviews and penetration testing for Web applications, APIs, and Web3 infrastructure (Smart Contracts, DApps, Wallets).
• SDL & DevSecOps: Drive the Security Development Lifecycle (SDL) by integrating SAST/DAST automation tools into CI/CD pipelines.
• Incident Response: Handle application-level security incidents, conduct root-cause analysis, and track vulnerability remediation.
• Security Architecture Review: Participate in product design reviews to identify architectural/logical flaws and provide security hardening solutions.

Requirements:

• Core AppSec Skills: 2+ years of experience in AppSec or PenTesting; solid knowledge of OWASP Top 10 and web/API vulnerability exploitation.
• Web3 / Blockchain Experience: Familiar with Web3 threat vectors (e.g., Reentrancy, Flash Loans, Signature Forgery, DApp attacks). Hands-on experience in Solidity auditing or DApp/Wallet testing is a strong plus.
• Tooling & Automation: Proficient with security tools (e.g., Burp Suite, Slither, Mythril, Checkmarx) and capable of scripting in Python or Go for automation.
• Communication: Excellent cross-functional communication skills to effectively drive remediation with development teams.