# Application Security Engineer

**Company**: GovTech
**Location**: Singapore
**Experience**: mid
**Job type**: full-time
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/govtech/jobs/4009603201?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/job/application-security-engineer-2e231dc9-bb6/

## Description

GovTech is the lead agency driving Singapore's Smart Nation initiatives and public sector digital transformation.

As an Application Security Engineer, you will strengthen the security of internally developed products by embedding security into the software development lifecycle.

Responsibilities:

- Own and deliver application security assurance for internally developed products, integrating security practices throughout the SDLC.

- Embed security checks into CI/CD pipelines, including SAST, DAST, software composition analysis, and secret detection, to identify vulnerabilities early and support timely remediation.

- Promote shift-left security by advising development teams on secure design, implementation, and coding practices.

- Conduct targeted code reviews to uncover flaws before formal penetration testing.

- Collaborate with the Infrastructure Security Specialist to validate vulnerabilities and risk scenarios ahead of formal testing.

- Review third-party penetration test results, validate findings, prioritize risks, and recommend practical remediation.

- Conduct threat modeling and help strengthen the security of APIs, web applications, and modern application architectures.

- Work with engineering teams to track remediation and improve security practices across development and release workflows.

- Communicate technical findings clearly, translating vulnerabilities into business and operational risks.

Requirements:

- Solid knowledge of web and API security principles, including the OWASP Top 10 and OWASP API Security Top 10.

- Familiarity with modern application architectures, especially authentication, authorization, and session management.

- Ability to read and understand code in languages such as Python, Java, or JavaScript.

- Experience with application security testing tools such as Burp Suite, OWASP ZAP, Postman, and proxy debuggers.

- Understanding of threat modeling, business logic vulnerabilities, and risk-based prioritization.

- Knowledge of CI/CD security practices, including integrating SAST, DAST, and open-source dependency scanning into development workflows.

- Strong communication skills, with the ability to explain technical vulnerabilities and remediation options to varied audiences.

Benefits:

- GovTech is an equal opportunity employer committed to fostering an inclusive workplace that values diverse voices and perspectives.

- Our employee benefits are based on a total rewards approach, offering a holistic and market-competitive suite of perks.

- We champion flexible work arrangements (subject to your job role) and trust that you will manage your own time to deliver your best, wherever you are, and whatever works best for you.

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- web and API security principles
- OWASP Top 10
- OWASP API Security Top 10
- modern application architectures
- authentication
- authorization
- session management
- Python
- Java
- JavaScript
- application security testing tools
- Burp Suite
- OWASP ZAP
- Postman
- proxy debuggers
- threat modeling
- business logic vulnerabilities
- risk-based prioritization
- CI/CD security practices
- SAST
- DAST
- open-source dependency scanning

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/govtech/jobs/4009603201?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)