Principal Digital Security Architect

About the role

Encora is looking for a Principal Digital Security Architect in Kuala Lumpur to design the security architecture of its banking and fintech platform. The role covers API and ecosystem security, identity and access management, secure development practices and data privacy, and delivers reusable security patterns for authentication, mobile and cloud.

Key responsibilities

• API & ecosystem security: architect the security layer of the API gateway (e.g. Kong, Apigee, AWS Gateway) with rate limiting, throttling and authorization policies, and design secure integrations with third-party partners such as Fintechs, credit bureaus and payment processors.
• Microservices mesh: define service-to-service trust using mTLS and cryptographic authentication.
• Identity and access management: own the CIAM architecture, including biometric binding, adaptive MFA and step-up authentication, and set OAuth 2.0 and OIDC standards with FAPI-compliant token handling.
• Secure SDLC: lead threat modeling sessions with product owners and work with DevOps on secure-by-default libraries, such as a shared encryption wrapper.
• Data privacy and cryptography: design field-level encryption for PII and banking secrets, and systems supporting the right to be forgotten without compromising ledger immutability.
• Deliver security design patterns for authentication, authorization, SSO, MFA and partner security, for mobile and edge, and for API, container, cloud and AI security.

Required profile

• 8+ years of experience combining software engineering and security architecture.
• Ex-developer who can read code (Java, Kotlin, React or Node.js).
• Strong preference for candidates who have secured payment gateways, ledgers or wallets.
• Business-aligned mindset: security that reduces risk without destroying the user experience, and pragmatic judgment between blocker fixes and risk acceptance.

Required skills

• Deep knowledge of REST and GraphQL security.
• OAuth 2.0 and OIDC, including JWT signing and JWKS key rotation.
• Mobile security: understanding of KeyStore/Keychain and protection against emulator and bot abuse.