Key Responsibilities

Lead application security reviews, including manual code audits of Java and Go applications and supporting components in other languages, and provide clear, practical remediation guidance.
Assess application architecture, business logic and data flows to identify security risks, and recommend proportionate controls.
Define secure development standards and integrate security checks, including static analysis, into the software development lifecycle (SDL).
Build, extend or tune static and dynamic analysis tooling so that common vulnerability classes are found early and at scale.
Perform threat modelling, secure architecture reviews and penetration testing of web, backend and mobile or desktop applications (including iOS and macOS).
Investigate and validate relevant emerging vulnerabilities, assess their impact on our systems, and guide remediation.
Review and improve operational security controls for sensitive systems, such as authorisation, segregation of duties, approval workflows and standard operating procedures (SOPs).
Work with engineering teams to prioritise security findings and verify that fixes address the underlying risks.
Provide technical guidance and mentor engineers on secure design and coding practices.

Job Requirements:

Bachelor's degree in Computer Science, Engineering, Information Security or a related field, or equivalent practical experience.
At least 6 years of professional application security experience, including technical ownership of security initiatives across engineering teams.
Strong Java and/or Go skills, with hands-on experience manually auditing applications built with frameworks such as Spring or Gin.
Deep understanding of common application vulnerabilities, including those in the OWASP Top 10, and of business logic flaws, access control weaknesses and authentication or session-handling issues.
Practical experience in threat modelling, secure architecture reviews, penetration testing and implementing a secure software development lifecycle.
Experience developing or customising code analysis tooling (for example, rules, bytecode analysis or control-flow analysis) to detect vulnerabilities.
A demonstrated vulnerability research track record, such as CVE disclosures, vendor security acknowledgements or bug bounty contributions.
Ability to evaluate security trade-offs, establish standards and guide remediation across complex applications.
Strong communication and documentation skills in English, with the ability to explain risks to technical and business stakeholders.

Advantageous

Reverse engineering experience on iOS, macOS or Android applications, including analysis of authentication mechanisms and communication protocols.
Experience in vulnerability research on operating system components or frameworks.
Experience designing or reviewing encryption, data protection or Trusted Execution Environment (TEE) solutions.
Experience using automation or AI-assisted tools to support security reviews, with independent validation of findings.
Experience working in a regulated financial services environment.

Disclaimer: The company is committed to ensuring theprivacy and security of your information. By submitting this form, youconsent to the collection, processing, and retention of the information youprovide. The data collected (which may include your contact details,educational background, work experience and skills) will be used solely for thepurpose of evaluating your qualifications for the position you're applying for.Your data will be stored securely and retained for the duration necessary tofulfill our hiring process. If you are not selected for the position, your datawill be kept on file for a limited period in case future opportunities arise.You have the right to access, correct, or delete your data at any time bycontacting us at Quess Singapore | A Leading Staffing Services Provider inSingapore (quesscorp.sg)

This is inpartnership with the Employment and Employability Institute Pte Ltd (e2i).

e2i is theempowering network for workers and employers seeking employment andemployability solutions. e2i serves as a bridge between workers andemployers, connecting with workers to offer job security through job-matching,career guidance and skills upgrading services, and partnering employers toaddress their manpower needs through recruitment, training, and job redesign solutions.e2i is a tripartite initiative of the National Trades Union Congress setup to support nation-wide manpower and skills upgrading initiatives. Byapplying for this role, you consent to Quesscorp Singapore's PDPA and e2i'sPDPA. By submitting your application for this position, youconsent to the collection, use, and disclosure of your personal data byQuesscorp and its recruitment partners, including Employment andEmployability Institute Pte Ltd, for the purpose of i) employment facilitationand ii) data and statistical analysis. You may find out more informationon the PDPA policies at Quesscorp website and[https://www.e2i.com.sg/pdpa/].

Principal Application Security Engineer (Contract Role)