Lead Application Security Engineer

About the role

Agoda's Security Department oversees security, compliance, GRC and security operations for the company. As a Lead Application Security Engineer you will work in a fast-paced DevSecOps environment where code changes rapidly, and you will bring security testing into a continuous deployment and integration flow.

Key responsibilities

• Play a lead role in developing and designing application-level security controls and standards
• Perform application security design reviews against new products and services
• Track and prioritize all security issues
• Build internal security tools that help fix security problems at scale
• Perform code review and drive remediation of discovered issues
• Enable automated security testing at scale to measure vulnerability and report on risk across microservice, web and mobile platforms
• Execute security tests on thousands of servers across on-premise and public cloud data centers

Required profile

• Strong foundations in software engineering
• Minimum 7 years of technical experience combining threat modeling, secure coding, identity management and authentication, software development, cryptography, system administration and network security
• Minimum 2 years of software development life cycle experience in one or more languages such as Rust, Python, Go or Node.js
• Minimum 1 year of experience with public or private cloud environments (OpenShift, Rancher, Kubernetes, AWS, GCP, Azure)
• Experience running assessments using OWASP MASVS and ASVS
• Working knowledge of exploiting and fixing application vulnerabilities
• Strong background in threat modeling and in-depth knowledge of common web application vulnerabilities (OWASP Top 10)
• Familiarity with automated dynamic scanners, fuzzers and proxy tools
• Analytical mind, strong communication skills, and relocation package available for Bangkok, Thailand

What we offer

• Hybrid working model with a 30-day remote working allowance
• WFH set-up allowance and employee accommodation discount
• Annual CSR/volunteer time off, Benevity subscription, Headspace, Odilo and Udemy subscriptions, and access to an Employee Assistance Program
• Enhanced parental leave and life, TPD and accident insurance