Senior Cybersecurity Engineer
First seen by Alion on Nov 3, 2026.
We are looking for a Senior Cybersecurity Engineer (Application Security) to own the security of every application we build and run: our Vision AI and agentic AI platforms, web and mobile apps, APIs and cloud infrastructure. As a senior individual contributor, you will find and fix weaknesses across the stack, build security into how engineers design, code and ship, and be the go-to person for security decisions.
Key Responsibilities :
a) Assess and harden all applications (web, backend, APIs, mobile, databases, cloud/containers); run threat modelling and design reviews, incl. LLM/agent products.
b) Do hands-on code reviews and penetration testing, coordinate external pentests, and drive fixes to closure with engineering.
c) Build security into CI/CD: code, dependency and container image scanning, secrets detection and IaC checks.
d) Strengthen identity and access (authN/authZ, RBAC, secrets/key management, encryption); harden AWS and Kubernetes/Docker workloads.
e) Set up security monitoring, alerting and incident response; lead technical response; manage vulnerabilities end to end and report to management.
f) Support client and regulatory requirements (security questionnaires, PDPA, ISO 27001-style controls); coach developers and write security standards.
Requirements
Qualifications & Requirements:
a) Education : Degree in Computer Science, Cybersecurity or a related field, or equivalent experience.
b) Experience : At least 5 years in cybersecurity or software engineering, with 3 or more years focused on application
security.
c) Skills & Competencies: OWASP Top 10 / API Security Top 10; Burp Suite or OWASP ZAP, code and dependency scanners; code review in Python, JS/TS, Java or Go; securing AWS, Linux, Docker and Kubernetes; OAuth 2.0, OIDC, JWT, TLS, secrets management; clear communication and a practical, risk-based approach. Nice to have: OSCP/OSWE/CISSP/GWAPT/AWS Security.
Skills
Cybersecurity Risk Management, Cybersecurity Compliance, Cybersecurity Threat Identification, Open Web Application Security Project (OWASP), Application Programming Interface (API), Security Awareness, OAuth, Docker Compose, Kubernetes