DevSecOps Engineer - Application Security
Prudential plc2 days ago
Kuala Lumpur, MalaysiaMid Level
Responsibilities
- Validate, triage, analyze, enrich, prioritize, and normalize vulnerability findings across application security testing tools.
- Perform false-positive analysis, de-duplication, severity assessment, exploitability evaluation, and business-impact analysis.
- Improve vulnerability triage operations and identify recurring vulnerability trends across projects and business units.
- Design and implement automation workflows for enrichment, de-duplication, ticketing, and triage efficiency.
- Support security-tool proof-of-concept and selection processes and integrate selected tools into triage workflows.
- Provide technical input for project-release triage readiness and guidance on secure coding practices.
- Collaborate with application teams, developers, DevOps teams, BISOs, and other technology stakeholders across multiple regions.
- Create and maintain knowledge-base documentation, playbooks, reports, records of risk decisions, and triage actions.
Requirements
- Bachelor’s degree in Information Security, Computing Engineering, or equivalent.
- At least 4 years of cybersecurity experience, preferably in vulnerability management, application security, or a vulnerability operations team.
- Strong knowledge of web application security, API security, OWASP Top 10, CWE, CVE, CVSS, EPSS, KEV, MITRE ATT&CK, and vulnerability prioritization.
- Ability to evaluate threats and exploitation techniques including SQL injection, XSS, CSRF, SSRF, and RCE.
- Proficiency in one or more of JavaScript, Python, PowerShell, or Bash, along with automation platforms and data visualization tools.
- Advanced knowledge of vulnerability assessment tools, threat modeling, SAST, DAST, SCA, container scanners, and vulnerability risk-scoring methodologies.
- Experience with multi-cloud and enterprise-scale environments, including AWS, Azure, and GCP.
- Knowledge of NIST and ISO 27001 security frameworks.
- Experience or aptitude for building automation scripts, queries, or workflows to reduce triage workload.
- Strong analytical, stakeholder communication, incident coordination, technical writing, and documentation skills.
- Global or regional experience is desirable, and financial-services or technology-industry experience is a bonus.
- Security+, OSCP, CISSP, or other relevant information-security certifications are preferred.
Benefits
- Prudential is an equal opportunity employer and supports reasonable adjustments for individual physical or mental health requirements.
Tech Stack
Categories
About Prudential plc
Prudential plc provides life and health insurance and asset management for consumers across Asia and Africa, including through its Eastspring Investments arm. The public company is headquartered in Hong Kong with dual primary listings in Hong Kong and London, and traces its origins to 1848 in the UK. Its products span protection, savings, and retirement, distributed via agents, bancassurance partners, and digital channels.