Application Security Engineer AppSec

Overview

Secure BJAK's web applications, APIs, and backend services while coordinating with mobile stakeholders on cross-platform risks. Embed security into design, development, testing, and release workflows.

What you'll do

• Perform security reviews, code reviews, and testing for web applications, APIs, and backend services.
• Identify, prioritize, and help remediate injection, broken access control, authentication, and configuration vulnerabilities.
• Integrate SAST, DAST, software composition analysis, and secrets scanning into CI/CD pipelines.
• Conduct threat modeling and design reviews for features, APIs, third-party integrations, and major changes.
• Coordinate with mobile engineers on cross-platform findings and backend controls protecting native iOS and Android clients.
• Own application security implementation for SC TRM and BNM RMiT, including secure SDLC evidence, vulnerability management, testing, and audit remediation.
• Provide secure coding guidance, track remediation, retest fixes, and improve developer security awareness.

What you'll need

• Degree in Computer Science, Cybersecurity, or related discipline, or equivalent experience.
• 3+ years in application security, penetration testing, or secure software development.
• Experience implementing and owning SC TRM and BNM RMiT application security and secure SDLC requirements.
• Strong understanding of OWASP Top 10, OWASP API Security Top 10, web vulnerabilities, API security, and secure design.
• Hands-on experience with Burp Suite, OWASP ZAP, SAST, DAST, and dependency scanning tools.
• Experience reviewing TypeScript/Node.js and Python services.
• Ability to work closely with developers, explain findings, and support remediation.
• Strong English communication is required.

Nice to have

• Familiarity with Swift, Kotlin, AWS, and GCP.

Details

• Location: China.
• English is the main working language across global teams.