[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"job-devsecops-engineer-application-security-prudential-services-asia-sdn-bhd-malaysia-de-global":3},{"id":4,"slug":5,"title":6,"description":7,"company":8,"is_featured":11,"featured_until":7,"is_active":12,"deactivated_at":7,"is_enriched":12,"processed_job_posting_json":13,"processed_latitude":91,"processed_longitude":92,"processed_employment_types":93,"processed_working_hours":94,"processed_working_hours_labels":96,"processed_home_office":97,"processed_salary_min":88,"processed_salary_max":89,"processed_salary_currency":85,"processed_salary_source":98,"processed_benefits":99,"processed_benefits_labels":102,"processed_industry":103,"processed_skills":7,"processed_job_location":104,"processed_full_address_gmaps":106,"processed_street_gmaps":108,"processed_city_gmaps":110,"processed_postal_code_gmaps":111,"processed_country_gmaps":113,"processed_country_iso_code_gmaps":115,"full_description":16,"formatted_description":116,"processed_employment_types_labels":36,"processed_home_office_labels":34,"processed_industry_labels":38,"processed_it_skills":117,"processed_it_skills_labels":119,"processed_soft_skills":120,"processed_soft_skills_labels":122,"processed_job_expertise_skills":123,"processed_job_expertise_skills_labels":124,"processed_language_requirements":125,"processed_total_experience_years":121,"processed_professional_field":132,"processed_professional_field_labels":134,"processed_leadership_role":11,"processed_date_posted":20,"raw_job_url":135,"apply_url":7,"raw_hiringOrganization_logo_url":7,"translations":7,"canonical_industry_key":136,"canonical_industry_label":137,"max_cpc":138,"actual_cpc":7},96245,"devsecops-engineer-application-security-prudential-services-asia-sdn-bhd-malaysia","DevSecOps Engineer - Application Security",null,{"name":9,"slug":10,"logo_url":7},"Prudential Services Asia Sdn Bhd (Malaysia)","prudential-services-asia-sdn-bhd-malaysia",false,true,{"@context":14,"@type":15,"title":6,"description":16,"hiringOrganization":17,"datePosted":20,"validThrough":21,"jobLocation":22,"jobLocationType":34,"employmentType":35,"industry":37,"skills":39,"baseSalary":83},"https:\u002F\u002Fschema.org\u002F","JobPosting","Prudential’s purpose is to be partners for every life and protectors for every future. Our purpose encourages everything we do by creating a culture in which diversity is celebrated and inclusion assured, for our people, customers, and partners. We provide a platform for our people to do their best work and make an impact to the business, and we support our people’s career ambitions. We pledge to make Prudential a place where you can Connect, Grow, and Succeed. Job Scope: The incumbent is expected to be a proficient security engineer with strong expertise in DevSecOps technologies as well as vulnerability remediation. This role forms a part of the Vulnerability Operations Centre team (VOC) by ensuring that vulnerabilities are accurately validated and prioritized. The incumbent is responsible for triaging, analyzing, and enriching vulnerability findings across application security testing tools, including performing research and exploration to improve triage processes through potential open source or commercial tooling. The incumbent is also expected to work closely with the application team, developers and BISOs within the security function to support multiple lines of business units located across Asia, Africa and UK. Principal accountabilities: Possess strong understanding of vulnerability types, (OWASP Top 10, CWE, CVE, misconfiguration, insecure API) and be able to clearly explain common attack techniques. Having a solid grasp of web application security and API security principles. Demonstrate strong capability in vulnerability prioritization, with the ability to access risk based on exploitability, asset criticality and business context. Uplift DevSecOps vulnerability triage operations to enhance effectiveness and efficiency. Perform manual and semi-automated triage of vulnerability findings to provide expert judgment on severity, exploitability, and business impact. Conduct false positive analysis, de-duplication, and tool output normalization. Provide technical input during project release to prepare triage readiness. Identify and correlate recurring vulnerability data across projects or business units to observe trends to simplify or streamline triage processes. Collaborate with application teams, DevOps, BISOs and developers effectively by explaining vulnerabilities and risks clearly to application team. Participate in security tool PoC\u002FPoV and selection processes. Drive implementation and integration of selected tools into the triage workflow to enhance automation, data accuracy and analyst efficiency. Design and implement automation workflows for enrichment, de-duplication, and ticketing Contribute to strategic planning and continuous improvement of VOC capabilities. Prepare documentation and reporting on knowledge base documentation and playbook creation. Maintain accurate records of analysis, risk decisions and triage actions. Provide guidance to developers and application teams on secure coding best practices. Core Competences Required: •Familiarity with security standards, CVSS scoring, EPSS, CWE, CVE, KEV database and MITRE ATT&CK, demonstrated experience with CVSS tuning, exploit intelligence, and SLA tagging. •Familiarity with exploitation techniques, able to explain and evaluate threats like SQL injection, XSS, CSRF, SSRF, RCE. •Proficiency in one or more scripting languages (JS, Python, PowerShell, Bash), and automation platforms, as well as data visualization tools. •Advanced knowledge of vulnerability assessment tools and threat modelling. •Embrace a positive mindset for growth to drive change within a legacy environment with technical debt and internal challenges. •Strong analytical and communication skills, Excellent stakeholder communication and incident coordination skills. Ability to collaborate and coordinate across differing teams across the different technology stacks of application, infrastructure, cloud, networking. •Ability to explain technical vulnerabilities clearly to developers and other stakeholders. •Possess critical thinking outside of traditional boundaries to trigger deep rooted problem solving and multi-disciplinary analytical skills. •Effective technical writing and documentation skills for SOPs and evaluation reports. Education and Experience: Bachelor’s degree in Information Security, Computing Engineering or equivalent. 4+ years in cybersecurity, preferably with a focus on vulnerability management, AppSec, or vulnerability operations team. Prior experience in working in a global\u002Fregional exposure is desirable, with prior experience in financial service and\u002For tech industry is a bonus. Have deep knowledge on security frameworks, NIST, ISO 27001. Experience in multi-cloud and enterprise-scale environments, Understanding of cloud environments (AWS, Azure, GCP) and their security implications. Experience with Vulnerability Tools, SAST, DAST, SCA, container scanners. Familiarity in the triage vulnerability operations and vulnerability risk scoring methodologies for identified application security findings\u002Fvulnerabilities. Experience in or aptitude for building automation scripts, queries or workflows to reduce triage workload. Relevant Information Security certification(s) preferred, such as Security+, OSCP, CISSP, are advantageous. Prudential is an equal opportunity employer. We provide equality of opportunity of benefits for all who apply and who perform work for our organisation irrespective of sex, race, age, ethnic origin, educational, social and cultural background, marital status, pregnancy and maternity, religion or belief, disability or part-time \u002F fixed-term work, or any other status protected by applicable law. We encourage the same standards from our recruitment and third-party suppliers taking into account the context of grade, job and location. We also allow for reasonable adjustments to support people with individual physical or mental health requirements. We are Prudential. For every life, we are partners. For every future, we are protectors. Prudential plc provides life and health insurance and asset management to 17 million customers across 20 markets in Asia and Africa. We are headquartered in Hong Kong and have dual primary listings on the Stock Exchange of Hong Kong and the London Stock Exchange. We are focused on four strategic regions: Greater China, ASEAN, India and Africa. Our customers are served by around 55,000 agents and more than 200 bank partners. Prudential plc is not affiliated in any manner with Prudential Financial, Inc., a company whose principal place of business is in the United States of America or with the Prudential Assurance Company, a subsidiary of M&G plc, a company incorporated in the United Kingdom. Find out more at www.prudentialplc.com Follow us on LinkedIn",{"@type":18,"name":19},"Organization","PSA Prudential Services Asia Sdn Bhd (Malaysia)","2026-10-20","2027-10-20",[23],{"@type":24,"address":25,"geo":30},"Place",{"@type":26,"addressLocality":27,"addressCountry":28,"addressRegion":29},"PostalAddress","Kuala Lumpur","MY","Wilayah Persekutuan Kuala Lumpur",{"@type":31,"latitude":32,"longitude":33},"GeoCoordinates",3.1437925,101.7157869,"ONSITE",[36],"PERMANENT",[38],"Insurance and Asset Management",[40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,54],"Python","JavaScript","PowerShell","Bash","Automation Platforms","Data Visualization Tools","SAST","DAST","SCA","Container Scanners","Cloud Platforms (AWS, Azure, GCP)","Analytical Skills","Communication Skills","Stakeholder Communication","Incident Coordination","Collaboration","Critical Thinking","Technical Writing","Documentation Skills","Problem Solving","Growth Mindset","Vulnerability Management","Application Security","DevSecOps","Vulnerability Triage","Vulnerability Prioritization","Risk Assessment","OWASP Top 10","CWE","CVE","CVSS Scoring","EPSS","KEV Database","MITRE ATT&CK","Threat Modeling","Exploitation Techniques","Secure Coding Best Practices","Security Frameworks (NIST, ISO 27001)","Automation Workflow Design","Security Tool PoC\u002FPoV","False Positive Analysis","De-duplication","Tool Output Normalization",{"@type":84,"currency":85,"value":86},"MonetaryAmount","MYR",{"@type":87,"minValue":88,"maxValue":89,"unitText":90},"QuantitativeValue",96000,144000,"YEAR",[32],[33],"permanent",[95],"FULL_TIME",[95],"onsite","estimated",[100,101],"Equal opportunity employer","Reasonable adjustments for physical or mental health requirements",[100,101],"insurance and asset management",[105],"psa, psa | kuala lumpur - menara prudential @ trx 15f, malaysia",[107],"Menara Prudential, Persiaran TRX Barat, Tun Razak Exchange, 55188 Kuala Lumpur, Wilayah Persekutuan Kuala Lumpur, Malaysia",[109],"Persiaran TRX Barat",[27],[112],"55188",[114],"Malaysia",[28],"Prudential’s purpose is to be partners for every life and protectors for every future. Our purpose encourages everything we do by creating a culture in which diversity is celebrated and inclusion assured, for our people, customers, and partners. We provide a platform for our people to do their best work and make an impact to the business, and we support our people’s career ambitions. We pledge to make Prudential a place where you can Connect, Grow, and Succeed.\n\n## Job Scope:\n\nThe incumbent is expected to be a proficient security engineer with strong expertise in DevSecOps technologies as well as vulnerability remediation. This role forms a part of the Vulnerability Operations Centre team (VOC) by ensuring that vulnerabilities are accurately validated and prioritized. The incumbent is responsible for triaging, analyzing, and enriching vulnerability findings across application security testing tools, including performing research and exploration to improve triage processes through potential open source or commercial tooling. The incumbent is also expected to work closely with the application team, developers and BISOs within the security function to support multiple lines of business units located across Asia, Africa and UK.\n\n## Principal accountabilities:\n\n- Possess strong understanding of vulnerability types, (OWASP Top 10, CWE, CVE, misconfiguration, insecure API) and be able to clearly explain common attack techniques.\n- Having a solid grasp of web application security and API security principles.\n- Demonstrate strong capability in vulnerability prioritization, with the ability to access risk based on exploitability, asset criticality and business context.\n- Uplift DevSecOps vulnerability triage operations to enhance effectiveness and efficiency.\n- Perform manual and semi-automated triage of vulnerability findings to provide expert judgment on severity, exploitability, and business impact.\n- Conduct false positive analysis, de-duplication, and tool output normalization.\n- Provide technical input during project release to prepare triage readiness.\n- Identify and correlate recurring vulnerability data across projects or business units to observe trends to simplify or streamline triage processes.\n- Collaborate with application teams, DevOps, BISOs and developers effectively by explaining vulnerabilities and risks clearly to application team.\n- Participate in security tool PoC\u002FPoV and selection processes.\n- Drive implementation and integration of selected tools into the triage workflow to enhance automation, data accuracy and analyst efficiency.\n- Design and implement automation workflows for enrichment, de-duplication, and ticketing\n- Contribute to strategic planning and continuous improvement of VOC capabilities.\n- Prepare documentation and reporting on knowledge base documentation and playbook creation.\n- Maintain accurate records of analysis, risk decisions and triage actions.\n- Provide guidance to developers and application teams on secure coding best practices.\n\n## Core Competences Required:\n\n- •Familiarity with security standards, CVSS scoring, EPSS, CWE, CVE, KEV database and MITRE ATT&CK, demonstrated experience with CVSS tuning, exploit intelligence, and SLA tagging.\n- •Familiarity with exploitation techniques, able to explain and evaluate threats like SQL injection, XSS, CSRF, SSRF, RCE.\n- •Proficiency in one or more scripting languages (JS, Python, PowerShell, Bash), and automation platforms, as well as data visualization tools.\n- •Advanced knowledge of vulnerability assessment tools and threat modelling.\n- •Embrace a positive mindset for growth to drive change within a legacy environment with technical debt and internal challenges.\n- •Strong analytical and communication skills, Excellent stakeholder communication and incident coordination skills. Ability to collaborate and coordinate across differing teams across the different technology stacks of application, infrastructure, cloud, networking.\n- •Ability to explain technical vulnerabilities clearly to developers and other stakeholders.\n- •Possess critical thinking outside of traditional boundaries to trigger deep rooted problem solving and multi-disciplinary analytical skills.\n- •Effective technical writing and documentation skills for SOPs and evaluation reports.\n\n## Education and Experience:\n\nBachelor’s degree in Information Security, Computing Engineering or equivalent. 4+ years in cybersecurity, preferably with a focus on vulnerability management, AppSec, or vulnerability operations team. Prior experience in working in a global\u002Fregional exposure is desirable, with prior experience in financial service and\u002For tech industry is a bonus. Have deep knowledge on security frameworks, NIST, ISO 27001. Experience in multi-cloud and enterprise-scale environments, Understanding of cloud environments (AWS, Azure, GCP) and their security implications. Experience with Vulnerability Tools, SAST, DAST, SCA, container scanners. Familiarity in the triage vulnerability operations and vulnerability risk scoring methodologies for identified application security findings\u002Fvulnerabilities. Experience in or aptitude for building automation scripts, queries or workflows to reduce triage workload. Relevant Information Security certification(s) preferred, such as Security+, OSCP, CISSP, are advantageous.\n\nPrudential is an equal opportunity employer. We provide equality of opportunity of benefits for all who apply and who perform work for our organisation irrespective of sex, race, age, ethnic origin, educational, social and cultural background, marital status, pregnancy and maternity, religion or belief, disability or part-time \u002F fixed-term work, or any other status protected by applicable law. We encourage the same standards from our recruitment and third-party suppliers taking into account the context of grade, job and location. We also allow for reasonable adjustments to support people with individual physical or mental health requirements.\n\nWe are Prudential. For every life, we are partners. For every future, we are protectors. Prudential plc provides life and health insurance and asset management to 17 million customers across 20 markets in Asia and Africa. We are headquartered in Hong Kong and have dual primary listings on the Stock Exchange of Hong Kong and the London Stock Exchange. We are focused on four strategic regions: Greater China, ASEAN, India and Africa. Our customers are served by around 55,000 agents and more than 200 bank partners. Prudential plc is not affiliated in any manner with Prudential Financial, Inc., a company whose principal place of business is in the United States of America or with the Prudential Assurance Company, a subsidiary of M&G plc, a company incorporated in the United Kingdom. Find out more at www.prudentialplc.com Follow us on LinkedIn",{"sca":118,"bash":118,"dast":118,"sast":118,"python":118,"javascript":118,"powershell":118,"container scanners":118,"automation platforms":118,"data visualization tools":118,"cloud platforms (aws, azure, gcp)":118},3,[40,41,42,43,44,45,46,47,48,49,50],{"analytical skills":121,"communication skills":121,"stakeholder communication":121,"incident coordination":121,"collaboration":121,"critical thinking":121,"technical writing":121,"documentation skills":121,"problem solving":121,"growth mindset":118},4,[51,52,53,54,55,56,57,58,59,60],{"cve":121,"cwe":121,"epss":121,"devsecops":121,"cvss scoring":121,"kev database":121,"mitre att&ck":121,"owasp top 10":121,"de-duplication":121,"risk assessment":121,"threat modeling":121,"application security":121,"vulnerability triage":121,"incident coordination":121,"security tool poc\u002Fpov":118,"exploitation techniques":121,"false positive analysis":121,"vulnerability management":121,"tool output normalization":121,"automation workflow design":118,"secure coding best practices":121,"vulnerability prioritization":121,"security frameworks (nist, iso 27001)":121},[61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,54],{"detected_language_jobad":126,"required":127},"en",[128],[129],{"language":130,"level":131},"ENGLISH","C1",[133],"Information and Communications Technology",[133],"https:\u002F\u002Fprudential.wd3.myworkdayjobs.com\u002Fen-us\u002Fprudential\u002Fjob\u002Fkuala-lumpur-group-head-office\u002Fdevsecops-engineer---application-security_26100191","insurance","Insurance",1]