Full Time Security Engineer Jobs, in Shortcut Asia Federal Territory - Maukerja

About the opportunity

We are looking for an experienced engineer to take significant ownership of security across a fast-growing regional fintech operating across Southeast Asia.

This role sits close to engineering and reports directly to the CTO. It is not primarily a governance, audit or policy role. The objective is to build security into the way the organisation designs, develops, deploys and operates technology.

We are deliberately open to two types of profiles:

• Established Security Engineers looking for broader technical ownership; or
• Strong Software, DevOps, SRE, Cloud or Platform Engineers who have developed a strong interest in security and want to make it their primary focus.

You do not need to tick every box below. Strong engineering fundamentals, security mindset and the ability to learn quickly matter more than having followed a traditional cybersecurity career path.

What you'll own

• Cloud & Identity Security

Own security across the company's Azure environment, including cloud infrastructure, Kubernetes workloads, identity, secrets, network boundaries and access controls.

Drive least-privilege access, privileged identity management, conditional access and secure workload identities.

Azure experience is not mandatory. If you have strong AWS, GCP or other cloud experience, we're interested. The underlying security and engineering principles matter more than the specific cloud platform.

• VAPT

Own Vulnerability Assessment & Penetration Testing end-to-end.

You will:

• Define scope and testing requirements
• Coordinate and manage external penetration testers
• Assess findings based on real exploitability and business risk
• Work with engineers to drive remediation
• Coordinate retesting and closure
• Produce technical outcomes that satisfy enterprise and financial-sector partners

This isn't about forwarding a penetration-testing report to engineering. You own the outcome.

• SOC 2 & Security Controls

Help lead the organisation through SOC 2 Type II from the engineering side.

The compliance team will own the documentation and administrative process.

You will own the technical reality behind it: designing and implementing controls, automating them where possible, producing technical evidence and ensuring those controls actually work.

You'll also contribute to ISO 27001 and other regulatory/security requirements relevant to a regional fintech.

• Detection & Incident Response

Build and continuously improve security detection across cloud infrastructure, identity, Kubernetes, applications and engineering systems.

Develop useful, low-noise detections together with practical incident-response runbooks.

Support incident investigation, post-incident reviews and tabletop exercises so that the organisation becomes better prepared as it scales.

• AI & Security Automation

This is an AI-first engineering organisation.

We want security to operate the same way.

You'll explore how AI and automation can improve areas such as:

• Alert triage and enrichment
• Vulnerability analysis and prioritisation
• Evidence collection
• Access reviews
• Security monitoring
• Security operations workflows

You'll also help secure the organisation's own use of AI — including LLMs, internal agents, tools and workflows that may interact with sensitive financial, payroll and identity data.

That means thinking about emerging risks such as prompt injection, data exfiltration, tool permissions, agent identities, auditability and appropriate human controls.

• Secure SDLC & Data Flows

Embed security directly into how software is built.

Work alongside engineers on application security, dependency and secret scanning, SAST/DAST, software supply chain security, authentication/authorisation, APIs, data flows and CI/CD.

The objective is not to introduce another approval gate.

It's to make the secure way the easiest way to build.

What we're looking for

You may already be working in cybersecurity, cloud security or DevSecOps.

Alternatively, you may be a strong Software Engineer, SRE, DevOps, Cloud or Platform Engineer who has consistently gravitated toward security and now wants to specialise in it.

We'd like to see strong experience in several of the following areas:

• Cloud infrastructure and cloud security
• Identity and access management
• Kubernetes/container security
• DevOps, DevSecOps and CI/CD
• Infrastructure as Code
• Application security
• Vulnerability management or penetration testing
• Security monitoring and incident response
• Automation and scripting
• Security controls and compliance
• Working in regulated environments such as fintech or banking

Experience with SOC 2, ISO 27001, Azure, VAPT or AI security is valuable, but we don't expect every candidate to already have all of it.

We're more interested in someone with strong technical fundamentals, good security instincts and the appetite to take ownership.

What makes this role different

This is an opportunity to help build the security engineering practice, rather than simply become another member of a large established security organisation.

You'll work closely with the CTO and engineering teams, have significant autonomy and influence how security evolves as the business scales.

For an established Security Engineer, that means broader ownership and the opportunity to shape the function.

For a Software, DevOps, SRE or Platform Engineer with a strong security mindset, it could be the opportunity to make security your full-time focus without having to start your career again from the bottom.

• Above all, we're looking for someone who believes security works best when it's engineered into the product, infrastructure and development process — not bolted on ************* Cybersecurity, with experience designing and implementing secure architectures.
• Application-focused security expertise, such as Application Security and Information Security, including secure coding practices, code review, and vulnerability management.
• Network security capabilities, including Network Security and Cybersecurity, with knowledge of firewalls, IDS/IPS, VPNs, and secure network design.
• Understanding of security standards and frameworks (e.g., OWASP Top 10, ISO 27001, NIST, CIS Controls) and familiarity with relevant regulations.
• Hands-on experience with security tools (e.g., SAST/DAST scanners, SIEM, endpoint protection, vulnerability scanners) and cloud platforms (e.g., AWS, Azure, GCP).
• Ability to analyze complex technical issues, communicate clearly with technical and non-technical stakeholders, and document findings and recommendations.
• Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent practical experience; relevant certifications (e.g., CISSP, OSCP, CEH) are an advantage.
• Experience working in or with software development teams, especially in agile environments; familiarity with DevSecOps practices is beneficial.