Senior Security Engineer

17 jam yang lalu

Jakarta Selatan, Jawa, Indonesia Jubelio Penuh waktu Rp 260 - Rp 480/tahun

Gratis dengan email atau Google

Simpan pekerjaan ini dan atur pencarian Anda

Buat akun gratis untuk menyimpan pekerjaan, membuat peringatan dan kembali ke daftar ini dari dasbor Anda.

Gratis dengan email atau Google

Dengan melanjutkan, Anda menyetujui Ketentuan & Kebijakan Privasi.

Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.
Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.
Own security risk scoring and the risk register, so that severity reflects real business impact.
Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escale only what matters.
Analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
Review code and architecture for security risks, and work with developers to fix them.
Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
Work with GRC so that security controls and evidence meet compliance requirements.
Coordinate with DevOps and development squads, who own remediation under our agreed SLA.

Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
Experience handling real security incidents and writing post-incident reviews.
Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.
Experience scoping and managing penetration tests with external vendors is an advantage.
Knowledge of compliance frameworks (ISO 27001, SOC 2, NIST Cybersecurity) is an advantage.
Good communicator who can influence engineers without formal authority. Fluent in English and Bahasa Indonesia.
Comfortable building from zero, with a strong sense of ownership. You will be the only security engineer at first.
Certifications such as OSCP, OSWE, CKS or CISSP are a plus, but demonstrated experience matters more.