Application Security Engineer

Location: Kuala Lumpur Malaysia

Role: Application Security Engineer

Department: Backend

About

Founded in Hong Kong in early 2017 is an AI-powered business messaging platform that helps companies manage customer conversations across chat calls and email all in one place.

Trusted by businesses in over 127 countries and recognized by G2 and SME100 enables fast-growing companies around the world to capture convert and retain customers at scale.

We operate as a globally distributed team with employees based around the world contributing to a diverse and inclusive culture. Join us and be part of a team that is shaping the future of customer conversation management!

Our Culture

At we move fast work smart and always keep our customers at the heart of what we do. Heres what we stand for:

• Solve Customer Problems: Every effort must solve real customer pain points. No guessworkjust real feedback and clear value!
• The 80/20 Rule: We focus on 20% of actions that create 80% of the value. Simple is powerfulit gets us moving fast.
• 100% Alignment 80% Accuracy: We aim 100% team alignment and 80% accuracy. Perfect plans can waitclear goals come first.
• Be Direct: We give honest feedback and tackle problems head-on. Clarity moves us forward!
• Own It and Support Each Other: We step up help out and drive outcomestogether.
• Build Human Connections: Work is better when we trust care and celebrate wins together. Were a team!

At security is a platform engineering discipline not a gate. Our security team builds Secure SDLC capabilities (Software supply-chain security AI-assisted SAST Security automation and AppSec perimeter controls) so developers can ship secure software fast.

Were hiring an Application Security Engineer to own two problems that define modern product security: the security of the code we write and the security of the code we depend on. That means threat modeling across application and infrastructure running a SAST pipeline that surfaces real vulnerabilities instead of noise and securing everything that enters our build from dependencies to IDEs and container images to CI/CD pipelines prioritized by whats actually exploitable.

This is a hands-on engineering role. Youll build the tooling and guardrails that prevent entire classes of vulnerabilities own vulnerability management from detection through verified remediation and act as technical first responder when incidents happen.

• Own software supply-chain security across our ecosystems i.e. dependency OSS license SCA and container image scanning ( Dependabot AWS ECR) enforced in CI/CD with reachability-based prioritization.
• Run application security testing end to end: threat modeling for new features and architecture changes AI-assisted SAST pipeline tuning and the PenTest from scoping through remediation and retest sign-off.
• Secure our GitHub organization and AWS infrastructure: secret scanning hardened CI/CD workflows IAM least-privilege Malware and threat detection and vulnerability management with AWS GuardDuty Inspector and Detective.
• Triage security signals and improve detection capability of EDR across all endpoints
• Own edge protection: AWS WAF rule tuning (rate limiting bot control managed rule sets) and Network Firewall policies to defend against DDoS injection attacks and malicious traffic.
• Act as primary technical responder for application security incidents and continuously fold advances in AppSec and AI-assisted security engineering back into our tooling

What Were Looking For

• You have 3 years in an application security role with strong AppSec fundamentals and can read well enough to trace a vulnerability to its root cause and validate the fix.
• You have secured software supply chains with dependency license and container scanning tools like Dependabot Trivy or Semgrep enforced as CI/CD policies with reachability-based prioritization.
• You have run threat modeling on new features and coordinated pentests from scoping through remediation.
• You have hardened CI/CD and GitHub organizations with branch protection secret scanning and Actions security such as OIDC pinned actions and scoped permissions.
• You have worked with AWS security services like GuardDuty Inspector Detective and CloudTrail for threat detection and WAF and Network Firewall for edge protection.
• You have built security tools scanners or CI plugins in Python TypeScript or Bash. Even better if youve used AI for your security automations!
• You can explain risks clearly to engineers and stakeholders in plain English.

• You will become part of an amazing culture with smart collaborative teammates who actually care about each others growth and success.
• You will grow more here than you would anywhere else that is a promise.
• Virtual events like talent shows Among Us nights and online game sessions to keep the fun going no matter where you are!
• We offer a highly competitive compensation package.
• Youll receive a mental health allowance to support your health and wellness needs.
• Flexible working environment and working hours that fit your lifestyle wherever youre based.