Senior AppSec Engineer: SAST/DAST, SBOM & Remediation

Exasoft; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

Exasoft is seeking an experienced security engineer to develop and enhance Malcode/CBOM capabilities, automate security workflows, and integrate tools across security repositories. The role focuses on hands-on SAST/DAST/SA and security analysis, with emphasis on vulnerability review and governance.

The ideal candidate will review code, logs, and findings, identify false positives, validate fixes, and lead remediation efforts while maintaining strong reporting and risk assessment practices.

Qualifications

• Strong experience in Application Security testing – SAST, DAST, SCA.
• Good knowledge of SBOM/CBOM and software supply-chain security.
• Experience in source code review and vulnerability assessment.
• Knowledge of Secure SDLC and vulnerability management.

Responsibilities

• Develop and improve Malcode and CBOM capabilities.
• Automate security workflows and processes.
• Integrate security tools and repositories.
• Perform SAST, DAST, SCA and security analysis.
• Review source code, logs, and security findings.
• Identify false positives, duplicates, and vulnerabilities.
• Validate fixes and perform retesting.
• Guide teams on vulnerability remediation.
• Track vulnerabilities, risks, and remediation status.
• Prepare security reports and support governance activities.

Skills

Application Security Testing

Software Supply Chain Security

Source Code Review

Secure SDLC

Scripting: Python/PowerShell

Security Reporting & Risk Assessment

Malware Analysis

Governance

Job description

Exasoft is seeking an experienced security engineer to develop and enhance Malcode/CBOM capabilities, automate security workflows, and integrate tools across security repositories. The role focuses on hands-on SAST/DAST/SA and security analysis, with emphasis on vulnerability review and governance.

The ideal candidate will review code, logs, and findings, identify false positives, validate fixes, and lead remediation efforts while maintaining strong reporting and risk assessment practices.