T

Two95 International

DevSecOps Engineer

Security Engineering & ArchitectureConfirmed live in the last 24 hours
Full-timeKuala Lumpur, Federal Territory of Kuala Lumpur, Malaysia$10k - $11kIn-person

About the Job

Requirements

  • The role requires 6–8 years of experience.
  • Proficiency in programming languages such as Python, Java, JavaScript, or Go to understand and review code effectively.
  • Direct hands-on experience developing and securing web APIs and web applications, including REST, SOAP, and gRPC.
  • Direct hands-on experience with security testing of web services and web APIs.
  • Experience with API management solutions.
  • In-depth knowledge of REST, GraphQL, SOAP, and authentication mechanisms such as OAuth 2.0, OpenID Connect, and JSON Web Tokens.
  • Expertise identifying and mitigating API threats, including broken object-level authorization, injection, and security misconfiguration, and using dynamic and static application security testing tools such as Postman, Burp Suite, and Swagger.
  • Proficiency in scripting, primarily Python or Go, for automating security testing and developing security tools.
  • Understanding of security for cloud infrastructure such as AWS, Azure, or Google Cloud Platform; container security with Kubernetes and Docker; and API gateways.
  • Ability to perform STRIDE threat modeling and design secure APIs, including encryption using TLS, rate limiting, and input security.
  • Experience with attacker tactics, techniques, and procedures, and corresponding mitigation methods.
  • Knowledge of procedures, standards, and regulations for authorization and authentication, applied cryptography, and security vulnerabilities.

Responsibilities

  • Identify, mitigate, and prevent security vulnerabilities in organizational APIs throughout the software development lifecycle.
  • Conduct design reviews and threat modeling exercises for new APIs and features to identify potential attack vectors and weaknesses before development begins.
  • Perform ongoing governance and follow through with API owners to ensure implementation of threat-based requirements.
  • Support and consult with development and engineering teams on application security.
  • Develop, deliver, and maintain API security standard requirements and design patterns.
  • Validate implementation of API security controls against outputs of vulnerability testing tools to enable auditability and verifiability.
  • Serve as an API security technical advisor to application teams.
  • Perform security risk assessments for proposed application-related API changes.
  • Examine source code for security flaws, insecure patterns, and hardcoded credentials, and provide actionable feedback and remediation guidance to development teams.
  • Assist in investigating and analyzing application- and API-related security incidents, identifying root causes, and implementing remediation plans.
  • Develop and deliver secure coding guidelines and training programs for developers.
  • Enhance security monitoring and analyze API traffic logs for anomalies to detect and respond to real-time threats and business logic abuse.

Desired Qualifications

  • Knowledge of application threat modeling and remediation of OWASP API Top 10, CIS Top 10, and SANS Top 25.
  • Experience working with AWS or other cloud environments in development or architecture.
  • Experience with cloud and API security standards, including OWASP API Top 10 and CIS Top 20.

About the Company

Two95 International

Company size
Not listed
Company stage
Not listed
Total funding
Not listed
Headquarters
Not listed
Founded
Not listed

Recently Posted Jobs

Explore more opportunities at Two95 International

See more jobs