Lead Application Security Engineer

About the role

Encora is hiring a Lead Application Security Engineer in Kuala Lumpur for its Malaysia team. The role leads security design for new banking features and builds automated security tooling in the CI/CD pipeline, while mentoring developers and promoting a security-first culture.

Key responsibilities

• Lead design reviews for new banking features (payments, transfers, KYC) and identify logic flaws before code is written.
• Architect and maintain SAST, DAST and SCA tooling in the CI/CD pipeline (e.g. SonarQube, Snyk, GitLab CI) to block vulnerabilities automatically.
• Perform manual code audits on high-risk components such as authentication and ledger logic in Java, Kotlin or Swift.
• Deliver API, container, cloud and AI security design patterns so developers have secure templates for microservices and AI models.
• Mentor the development team through secure coding workshops and champion a "Security Champion" program.

Required profile

• 5+ years in application security with a background in software development.
• Experience in fintech or banking is a bonus.

Required skills

• Proficiency in at least one core language: Java (Spring Boot), Node.js or Go.
• Deep understanding of OWASP Top 10 and SANS Top 25.
• CI/CD integration experience (Jenkins, GitHub Actions).