Senior Security Engineer (AppSec / DevSecOps)

Responsibilities

• Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.
• Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.
• Own security risk scoring and the risk register, so that severity reflects real business impact.
• Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escalate only what matters.
• Analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
• Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
• Review code and architecture for security risks, and work with developers to fix them.
• Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
• Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
• Work with GRC so that security controls and evidence meet compliance requirements.
• Coordinate with DevOps and development squads, who own remediation under our agreed SLA.

Requirements

• Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
• Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
• Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
• Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
• Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
• Experience handling real security incidents and writing post-incident reviews.
• Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
• Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.
• Experience scoping and managing penetration tests with external vendors is an advantage.
• Knowledge of compliance frameworks (ISO 27001, SOC 2, NIST Cybersecurity) is an advantage.
• Good communicator who can influence engineers without formal authority. Fluent in English and Bahasa Indonesia.
• Comfortable building from zero, with a strong sense of ownership. You will be the only security engineer at first.
• Certifications such as OSCP, OSWE, CKS or CISSP are a plus, but demonstrated experience matters more.