Senior AppSec Engineer & Threat Modelling Leader

QUESSCORP SINGAPORE PTE. LTD.; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

QUESSCORP SINGAPORE PTE. LTD. in Singapore seeks a senior application security engineer to lead security reviews, manually audit Java and Go applications, and embed secure development practices across teams.

You will assess architecture, data flows and business logic to identify risks and define proportionate controls. You will also build or tune static/dynamic analysis tooling, perform threat modelling and penetration testing for web, backend and mobile/desktop apps, and mentor engineers on

Qualifications

• Bachelor's degree in Computer Science, Engineering, Information Security or a related field.
• At least 6 years of professional application security experience across engineering teams.
• Strong Java and/or Go skills, with hands-on auditing experience (Spring/Gin).
• Deep understanding of OWASP Top 10 and business logic, access control weaknesses and authentication/session handling issues.
• Practical experience in threat modelling, secure architecture reviews, penetration testing and implementing a secure SDLC.
• Experience developing or customizing code analysis tooling (rules, bytecode analysis or control-flow analysis).
• Demonstrated vulnerability research track record (e.g., CVEs, bug bounty contributions).
• Ability to evaluate security trade-offs and guide remediation across complex applications.
• Strong communication and documentation skills in English.

Responsibilities

• Lead application security reviews, including manual code audits of Java and Go applications and supporting components in other languages, and provide clear, practical remediation guidance.
• Assess application architecture, business logic and data flows to identify security risks, and recommend proportionate controls.
• Define secure development standards and integrate security checks, including static analysis, into the software development lifecycle (SDL).
• Build, extend or tune static and dynamic analysis tooling so that common vulnerability classes are found early and at scale.
• Perform threat modelling, secure architecture reviews and penetration testing of web, backend and mobile or desktop applications (including iOS and macOS).
• Investigate and validate relevant emerging vulnerabilities, assess their impact on our systems, and guide remediation.
• Review and improve operational security controls for sensitive systems, such as authorisation, segregation of duties, approval workflows and SOPs.
• Work with engineering teams to prioritise security findings and verify that fixes address the underlying risks.
• Provide technical guidance and mentor engineers on secure design and coding practices.

Skills

Java

Go

Threat modelling

Secure SDLC

Code auditing

Spring

Gin

OWASP Top 10

Mentoring engineers

Communication

Education

Bachelor's degree in Computer Science/Engineering/Information Security or related field

Tools

Static analysis tooling

Bytecode analysis

Control-flow analysis

Penetration testing tooling

Job description

QUESSCORP SINGAPORE PTE. LTD. in Singapore seeks a senior application security engineer to lead security reviews, manually audit Java and Go applications, and embed secure development practices across teams.

You will assess architecture, data flows and business logic to identify risks and define proportionate controls. You will also build or tune static/dynamic analysis tooling, perform threat modelling and penetration testing for web, backend and mobile/desktop apps, and mentor engineers on