Kerja Sepenuh Masa, ITSO – IT Security Officer di Alphaeus Pte Ltd - Maukerja

We are seeking an experienced IT Security Officer (ITSO) to strengthen the security of applications, IT systems, infrastructure, and cloud environments. The ideal candidate will have a strong background in application security, software development, cloud computing, cybersecurity risk assessment, vulnerability management, and incident response.

Key Responsibilities

• Review system architectures, data flows, interfaces, APIs, internet-facing entry points, and security controls to identify potential security risks.
• Conduct cybersecurity risk assessments for new and existing IT systems, applications, infrastructure, and cloud services.
• Apply application security principles and industry best practices, including the OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Perform static application security testing (SAST) using tools such as Fortify on Demand, SonarQube, or equivalent solutions.
• Support secure software development by integrating automated security testing into CI/CD pipelines and applying Agile and DevSecOps practices.
• Conduct threat modelling and develop threat profiles to identify, assess, and mitigate application security risks.
• Review remediation plans and supporting evidence to ensure identified security risks are adequately addressed.
• Track and manage security vulnerabilities, ensuring timely remediation, patching, and closure in accordance with established requirements.
• Monitor and investigate cybersecurity alerts and incidents, including malware, phishing, account compromise, data breaches, unauthorized access, and cloud security incidents.
• Manage cybersecurity incident response activities, including triage, investigation, containment, remediation, recovery, and post-incident reviews.
• Conduct security awareness training to promote cybersecurity best practices across the organization.
• Collaborate with stakeholders to communicate security findings, recommend improvements, and ensure compliance with established security requirements.

Requirements

• At least 5 years of combined work experience in software development, application security, and cloud computing, such as AWS.
• Good understanding of mobile and web application architectures, APIs, and related technologies and protocols, including REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles and industry best practices, including OWASP Top 10 and OWASP ASVS.
• Familiarity with Agile development, CI/CD, and DevSecOps practices, including tools such as GitLab, GitHub, and Ansible.
• Experience using SAST code-scanning tools such as Fortify on Demand, SonarQube, or equivalent.
• Strong analytical, problem-solving, and troubleshooting skills, with the ability to work independently.
• Good verbal and written communication skills, with the ability to collaborate effectively and engage with various stakeholders.
• Degree in a relevant discipline or an equivalent qualification.

Preferred Qualifications

• Experience in threat modelling and application security risk assessment.
• Experience working with Government Commercial Cloud (GCC) environments.
• Relevant professional certifications such as CISSP, OSCP, CCSP, CRISC, AWS Security Certification, or equivalent.