Lead Application Security Engineer at Encora (Kuala Lumpur, Malaysia)
Encora· Kuala Lumpur, Malaysia·
Job description
Key Responsibilities: ● Threat Modeling: Lead design reviews for new banking features (Payments, Transfers, KYC). Identify logic flaws before code is written. ● Pipeline Automation: Architect and maintain the SAST/DAST/SCA tooling in the CI/CD pipeline (e.g., SonarQube, Snyk, GitLab CI) to block vulnerabilities automatically. ● Code Review: Perform manual code audits on high-risk components (Authentication, Ledger logic) in Java, Kotlin, or Swift. ● Cloud & AI Patterns: Deliver API, container, cloud, and AI security design patterns. Ensure that developers have "paved roads" (secure templates) for deploying microservices and AI models. ● Culture: Act as a mentor to the development team, running secure coding workshops and championing a "Security Champion" program.
Technical Requirements: ● 5+ years in Application Security with a background in Software Development. ● Proficiency in at least one core language: Java (Spring Boot), Node.js, or Go. ● Deep understanding of OWASP Top 10 and SANS Top 25. ● Experience with CI/CD integration (Jenkins, GitHub Actions). ● Bonus: Experience in Fintech or Banking.
Why work at Encora
- Culture & Recognition: Certified “Great Place to Work” in multiple regions; recognized by Comparably for Career Growth, Best Engineering Team, Best Company for Diversity, and Company Happiness.
- Remote/Hybrid Policy: Flexible work-from-home scheme; remote workers in Mexico receive a monthly allowance of MXN 700 for internet/electricity, plus desk and chair after 3 months. No dress code, pet-friendly environment.
- Perks & Benefits (varies by location):
- Top-of-the-line MacBook Pro
- Unlimited book budget and training/certification support
- Private health insurance (including family) with dental and life insurance
- 12 days paid vacation from day one (Mexico), 5 days PTO, 30 days aguinaldo (mandatory annual bonus)
- Psychotherapy support (12 sessions covered fully)
- Savings fund, grocery vouchers, and snack stations in select offices
- Considerations: Compensation inconsistency across geographies and accounts; project-dependent stability; change fatigue from post-acquisition integration. Candidates should confirm review cycles, salary bands, and account assignment during interviews.