Lead, Cloud & DevSecOps Security Engineering
Confirmed on the employer's own hiring board on Nov 13, 2026. First seen by Alion on Nov 13, 2026.
About Setel:
The Future of Mobility
Introduced in July 2018, Setel is a mobile platform that aims to delight customers by innovating for better, inclusive mobility. Setel serves customers across Malaysia by powering one app as the constant companion to ease motorists’ journey across fueling, parking, EV charging, motor insurance, road tax, auto assistance, general purchases, and more across an ecosystem of PETRONAS petrol stations, retail partners, and online merchants.
Role Purpose:
Lead the design, implementation, and automation of security controls across cloud environments, CI/CD pipelines, and API architectures. Operating as
part of 1st Line Engineering under the CTO, this role embeds security directly into the software development lifecycle (SDLC) and cloud infrastructure,
driving security-as-code and executing code-level fixes for vulnerabilities identified during build stages or 2nd Line VAPT audits.
In This Role You Will:
- CI/CD Pipeline Security Automation: Integrate automated pre-production security testing tools (SAST, DAST, SCA, Container Scanning) directly into DevOps CI/CD deployment pipelines to catch bugs before code hits production environments.
- Security as Code (IaC): Develop, maintain, and enforce Infrastructure as Code (IaC) security scanning templates (Terraform, CloudFormation, Ansible) to catch cloud misconfigurations prior to deployment.
- Cloud Posture & API Security: Implement API security standards, OAuth/OIDC authentication policies, Cloud Security Posture Management (CSPM), and container security policies (EKS/AKS/K8s).
- VAPT Remediation Lead: Act as the primary technical hands-on lead to patch, re-engineer, and fix application and infrastructure flaws discovered during 2nd Line manual VAPT exercises or penetration tests.
- Remediation SLA Tracking: Coordinate with Software Developers and DevOps Engineers to ensure critical and high-severity VAPT findings are resolved within agreed SLA windows.
- Security Tooling Automation: Build custom scripts, tools, and API integrations to automate repetitive security workflows, developer feedback loops, and remediation pipelines.
- General Responsibilities: All employees are required to ensure adherence to the compliance of company policies, industry regulations and legal requirements.
You're A Great Fit If You Have:
- 6-9 years in cloud security architecture, DevSecOps leadership, and secure software engineering operating within a fast-paced CTO/Engineering organization.
- Proven track record of designing enterprise-wide DevSecOps strategies, establishing security-as-code standards, and leading engineering teams through complex VAPT remediation cycles.
- Designing zero-friction DevSecOps architectures, custom security orchestrations, automated developer feedback loops, and self-healing cloud posture automation (CSPM).
- Designing multi-cloud zero-trust architectures, service mesh security (Istio/Linkerd), API gateway authentication models, and microservices isolation.
- Strategizing structural code and infrastructure redesigns to permanently eliminate recurring classes of security vulnerabilities identified by 2LoD Red Team assessments.
- Certified DevSecOps Expert (CDE) or SANS SEC540 (Cloud Security and DevSecOps Automation).
- Certified Information Systems Security Professional (CISSP) or Certified Cloud Security Professional (CCSP).
- AWS Certified Solutions Architect - Professional or AWS Certified Security - Specialty.
- Designing immutable CI/CD pipeline deployment gates and automated audit logging to fulfill BNM RMiT system integrity and change management requirements.
- Structuring secure containerized environments and API payment gateways to align with PCI DSS v4.0 (Requirement 6, 8, & 10) and PayNet scheme security standards.
- Championing shift-left security architecture to maintain regulatory compliance without decreasing developer release velocity.
- VAPT Remediation Lead: Serves as the primary 1LoD engineering counterpart to 2LoD Cyber Defense (Red/Blue Teams) to review, prioritize, and allocate resources for deep application/cloud remediation.
- Formulates and defends technical compensating controls with 2LoD GRC when application code or legacy dependencies cannot be immediately patched.
- Collaborates with 2LoD Compliance Assurance to define mandatory deployment blocking conditions within CI/CD pipelines.
What Makes Working With Us Awesome
- Our people and culture- You will get to work with awesome and friendly colleagues with whom you can expect to collaborate well to deliver your work. Empowerment is given and you will get a lot of opportunities for peer learning.
- Availability of tools and applications: You will be provided with different tools to facilitate your work. Automate your work whenever possible so that you can focus on delivering impact for your role.
- Development-focused- Your learning and growth matter most to us. We are people-centric and always ready to help our people to define what they want to make an impact on and craft their learning plan accordingly.
Cool Perks/Benefits
- Hybrid working arrangement; Flexible working hours
- Relax and unwind in the leisure area with video games, board games, books, and more.
- Wear your favourite jeans, or any cool OOTD so that you can work comfortably (in style).
- Coffee, tea, or snacks are available for consumption at the pantry. Because you’ll be happier with a full tummy.
- A healthy body leads to a brilliant mind. Let’s get moving with the inter-company sports team.
- There will be workshops, talent shows, sports activities, and other events for sharing and bonding.
Personal Data Protection
Setel Ventures Sdn Bhd (“Setel”, “we”, “our” “us”) is committed to protecting and respecting your privacy. This Setel privacy statement (“Privacy Statement”) explains what personal data we collect about you, when and why we collect it, how we use it, the conditions under which we may disclose it to others, your rights to your personal data, and how we keep it secure. This Privacy Statement covers both our online and offline collection activities, including personal data that we collect through online platforms such as websites, applications, third-party social networks or our online and physical events, or through other third parties that we work with. Please read this Privacy Statement carefully to understand our views and practices regarding your personal data.
#LI-JT1