Senior AppSec Engineer

Get to know the team

The DevSecOps team at Grab is dedicated to integrating security practices into our development and operations processes. With a focus on ensuring the security and reliability of our services, we strive to stay ahead of emerging threats and protect our users' data.

Get to know the role

We are seeking a talented and experienced Senior AppSec Engineer to join our dynamic team. The ideal candidate will possess a strong background in AppSec tools, application security and automation. As a Senior AppSec Engineer, you will play a crucial role in architecting and implementing application security practices across our organization.

Responsibilities:

• Implement and maintain application security tools such as Static Security Testing, Dynamic security Testing, Dependency scanning solutions and Supply Chain Security.
• Develop and automate security processes using Python and Go Lang to enhance efficiency and scalability.
• Collaborate with cross-functional teams to integrate security into the software development lifecycle (SDLC) and CI/CD pipelines.
• Provide expertise and guidance on application security best practices and assist in the implementation of secure coding standards.
• Conduct security assessments, vulnerability scanning, and penetration testing to identify and remediate security vulnerabilities.
• Stay abreast of emerging security threats, industry trends, and best practices in DevSecOps.

Requirements

The Must-Haves:

• Bachelor's degree in Computer Science, Information Technology, or related field.
• 7+ years of security industry experience utilizing web/mobile application security and knowledge of the security / threat landscape.
• Proven experience in DevSecOps practices, including the implementation and management of DevSecOps tools such as GIT, SAST, DAST, Secret Scanning, and dependency scanning solutions.
• In-depth knowledge of application security principles, common vulnerabilities, and secure coding practices. Excellent knowledge of pen-testing tools and procedures for Web/Mobile.
• Demonstrated proficiency in setting up and managing CI/CD pipelines, particularly in platforms such as GitLab and Jenkins.
• Extensive experience in safeguarding software supply chains, ensuring the integrity and security of dependencies and components throughout the development lifecycle.
• Strong programming skills in Python and Go Lang with experience in automation and scripting.
• Excellent communication and collaboration skills with the ability to work effectively in a fast-paced, team-oriented environment.

The Nice-to-Haves:

• Experience with containerization technologies (e.g., Docker, Kubernetes) and cloud platforms (e.g., AWS, Azure, GCP) is a plus.
• Experienced in vulnerability management, patching automation, and understanding of VA/PT techniques
• Cyber Security certifications like OSCP/OSCE/CREST/CDE will be an added advantage