{"id":4173497,"url":"https://alion.io/job/assurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance","title":"Cybersecurity Engineer (Application Security - AI Assurance)","company":{"id":232832,"name":"Assurity Trusted Solutions","domain":"assurity.sg","url":"https://alion.io/company/assurity","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":92,"open_postings":34,"ghost_share":0,"stale_share":0.118,"repost_share":0,"time_to_fill_p50_days":94,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Singapore"],"countries":["SG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Checkmarx","optional":false},{"name":"CI/CD","optional":false},{"name":"CodeQL","optional":false},{"name":"Docker","optional":false},{"name":"Embeddings","optional":false},{"name":"Function Calling","optional":false},{"name":"Knowledge Graph","optional":false},{"name":"Least Privilege","optional":false},{"name":"Model Context Protocol","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Semgrep","optional":false},{"name":"Snyk","optional":false},{"name":"SonarQube","optional":false},{"name":"Structured Outputs","optional":false}],"status":"live","first_seen_at":"2026-11-12T15:22:07Z","employer_posted_date":"2026-11-12","last_verified_at":"2026-11-12T15:22:07Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.\nResponsibilities:\nBuild an AI-assisted workflow that generates draft threat scenarios for Threat-Risk Assessments (TRAs) from product information, prior assessments, threat patterns and the security second brain. Design the workflow for human review first, with a path towards generating more complete TRA content as reliability improves.\nCreate and maintain the security second brain that supports TRA work. Curate threat scenarios, attack techniques, security patterns, prior assessments, product context and review lessons with reliable sources, useful metadata, traceability and clear handling of outdated or unreliable content.\nBuild centralised code-scanning and white-box testing capabilities across source-code repositories and delivery pipelines to identify security bugs early. Integrate static analysis, dependency checks, secrets detection and other suitable checks, then help teams triage and fix meaningful findings.\nCreate a separate knowledge base for recurring Vulnerability Disclosure Programme (VDP) issues. Analyse historical findings, identify repeated weaknesses and root causes, map them to coding patterns and preventive controls, and track measurable reduction in recurrence as a key performance indicator.\nDevelop a controlled auto-patching workflow for vulnerabilities identified in penetration-test reports. Map findings to affected code or components, generate fixes or pull requests, run tests and security checks, validate that the finding is addressed, and work towards automatically applying safe fixes through a governed pipeline.\nWork closely with the Application Security lead, penetration tester and product engineers to validate findings, assess exploitability, review generated fixes and improve the quality of assurance outcomes.\nCreate an MCP service for the CISO team so that approved internal tools can be called through a consistent and secure interface. Define authentication, authorisation, input validation, logging, error handling, data boundaries and human approval points for consequential actions.\nBuild evaluation methods and test suites for AI-assisted assurance workflows. Measure the quality of generated TRA scenarios, code findings, proposed patches and tool calls, including false positives, missed issues, unsafe actions and cases requiring human intervention.\nTurn prototypes into maintainable services and reusable components with version control, testing, deployment, monitoring, documentation and operational support.\nDocument security assumptions, limitations, residual risks and operating procedures. State clearly when an automated result is advisory, incomplete or unsuitable for direct action.\nRequirements\nExperience with Semgrep, CodeQL, SonarQube, Snyk, Checkmarx or comparable code-security and software-composition tools.\nExperience analysing VDP or bug-report data, identifying recurring vulnerability patterns and measuring remediation or recurrence-reduction outcomes.\nExperience processing penetration-test reports and generating code changes, pull requests or automated remediation suggestions that can be tested and reviewed.\nExperience with retrieval-augmented generation, embeddings, vector search, knowledge graphs, document processing or maintaining a technical security knowledge base.\nExperience with MCP, tool gateways, agent registries, secure execution environments, Docker, AWS or other major cloud platforms\nExperience\nHands-on experience in application security, security engineering, penetration testing, secure software development, vulnerability research or a closely related technical security area.\nStrong programming and automation ability, preferably with Python, and experience integrating APIs, source-code tools, security platforms or developer workflows.\nExperience with code scanning, white-box testing, static analysis, dependency or secrets checking, secure code review, continuous integration and delivery pipelines, or comparable engineering practices.\nExperience building or operating AI applications, agents or workflow automation using large language models, tool calling, retrieval, structured outputs, evaluation or orchestration frameworks.\nGood understanding of web applications, APIs, authentication, authorisation, common vulnerability classes, cloud services, containers, networking and secure software delivery.\nAbility to investigate a security finding, reproduce or validate it, identify the affected code or component, and judge whether a proposed fix addresses the underlying weakness without introducing a regression.\nAbility to design secure tool integrations, including least-privilege access, input validation, approval gates, secrets handling, logging, monitoring and protection against data leakage or unsafe actions.\nStrong written communication and the judgement to explain technical findings, automation limitations and residual risk to both security practitioners and product teams.\nJoin us and discover a meaningful and exciting career with Assurity Trusted Solutions!\nThe remuneration package will commensurate with your qualifications and experience. Interested applicants, please click \"Apply Now\".\nWe thank you for your interest and please note that only shortlisted candidates will be notified.\nBy submitting your application, you agree that your personal data may be collected, used and disclosed by Assurity Trusted Solutions Pte. Ltd. (ATS), GovTech and their service providers and agents in accordance with ATS’s privacy statement which can be found at: https://www.assurity.sg/ or such other successor site.\nBenefits\nA wholly-owned subsidiary of GovTech.\nWe promote a learning culture and encourage you to grow and learn.\nContract Staff enjoys the same benefits as Permanent Employees.","description_format":"text","description_chars":6327,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Application Security","Vulnerability Management"],"lifecycle":[{"event":"open","at":"2026-11-12T15:22:07Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":94,"reasons":["conf:1","win:early"],"computed_at":"2026-11-12T16:59:53Z"},"pay":null,"html_url":"https://alion.io/job/assurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance","json_url":"https://alion.io/job/assurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance.json","meta":{"generated_at":"2026-11-12T16:59:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35664,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":232832},"rest":"https://alion.io/mcp/rest/get_company?id=232832"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fassurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fassurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fassurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/assurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fassurity-trusted-solutions-cybersecurity-engineer-application-security-ai-assurance"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4173497}},{"tool":"search_jobs","arguments":{"company":"assurity.sg","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4173497},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}