Application Security Engineer

GovTech Singapore is hiring an Application Security Engineer in Singapore, Singapore. Level rates it ; you can apply on GovTech Singapore.

Level's read on this job

On Level's scale, this cybersecurity role is Little AI ●○○○: aI is not part of the work.
Tools and skills the posting cites include Sast, Dast and application security.
Level classifies it as a mid-level role.
Level lists 273 other open roles at GovTech Singapore.
The role was posted in the last few days.

AI in this role

Application Security Engineer responsible for embedding security into the SDLC, conducting code reviews, and securing CI/CD pipelines.

SastDast

application-securitythreat-modelingci-cd-securitycode-reviewowasp

GovTech is the lead agency driving Singapore’s Smart Nation initiatives and public sector digital transformation. As the Centre of Excellence for Infocomm Technology and Smart Systems (ICT & SS), GovTech develops the Singapore Government’s capabilities in Data Science & Artificial Intelligence, Application Development, Smart City Technology, Digital Infrastructure, and Cybersecurity.

At GovTech, we offer you a purposeful career to make lives better where we empower our people to master their craft through robust learning and development opportunities all year round.

Play a part in Singapore’s vision to build a Smart Nation and embark on your meaningful journey to build tech for public good. Join us to advance our mission and shape your future with us today!

Learn more about GovTech at tech.gov.sg.

Job Description Summary As an Application Security Engineer, you will strengthen the security of internally developed products by embedding security into the software development lifecycle. You will partner with engineering and infrastructure security teams to identify and address risks early, improve CI/CD security controls, and help deliver secure applications from design through deployment.

Own and deliver application security assurance for internally developed products, integrating security practices throughout the SDLC.
Embed security checks into CI/CD pipelines, including SAST, DAST, software composition analysis, and secret detection, to identify vulnerabilities early and support timely remediation.
Promote shift-left security by advising development teams on secure design, implementation, and coding practices.
Conduct targeted code reviews to uncover flaws before formal penetration testing.
Collaborate with the Infrastructure Security Specialist to validate vulnerabilities and risk scenarios ahead of formal testing.
Review third-party penetration test results, validate findings, prioritize risks, and recommend practical remediation.
Conduct threat modeling and help strengthen the security of APIs, web applications, and modern application architectures.
Work with engineering teams to track remediation and improve security practices across development and release workflows.
Communicate technical findings clearly, translating vulnerabilities into business and operational risks.

Solid knowledge of web and API security principles, including the OWASP Top 10 and OWASP API Security Top 10.
Familiarity with modern application architectures, especially authentication, authorization, and session management.
Ability to read and understand code in languages such as Python, Java, or JavaScript.
Experience with application security testing tools such as Burp Suite, OWASP ZAP, Postman, and proxy debuggers.
Understanding of threat modeling, business logic vulnerabilities, and risk-based prioritization.
Knowledge of CI/CD security practices, including integrating SAST, DAST, and open-source dependency scanning into development workflows.
Strong communication skills, with the ability to explain technical vulnerabilities and remediation options to varied audiences.

What we offer you:

GovTech is an equal opportunity employer committed to fostering an inclusive workplace that values diverse voices and perspectives, as we believe that diversity is the foundation to innovation.

Our employee benefits are based on a total rewards approach, offering a holistic and market-competitive suite of perks. These include leave benefits to meet your work-life needs and employee wellness programs.

We champion flexible work arrangements (subject to your job role) and trust that you will manage your own time to deliver your best, wherever you are, and whatever works best for you.

Learn more about life inside GovTech at go.gov.sg/GovTechCareers.
Stay connected with us on social media at go.gov.sg/ConnectWithGovTech

How we rate this

Application Security Engineer at GovTech Singapore rates 0 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.

Classification

Little AI. AI is not part of the work.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Read the description and count the AI tools, models and workflows it names.

Key facts

Application Security Engineer is an open job at GovTech Singapore.
Level rates this role AI Level 1 of 4: Little AI.
The role is based in Singapore.
The job was posted on November 11, 2026.
Seniority: mid.
Applications are handled by GovTech Singapore. Apply on GovTech Singapore

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

Application SecurityThreat ModelingCi Cd SecurityCode ReviewOwaspSastDast

Also common in cybersecurity jobs at this level

AWS Azure Google Cloud Kubernetes Terraform C++

Pay

Typical cybersecurity job: $160k

This posting doesn't list pay. Use the typical cybersecurity figure when pay comes up. See cybersecurity jobs

Questions you could be asked

Tell me about a project where application security was part of your work. What did you do?
Tell me about a project where threat modeling was part of your work. What did you do?
Tell me about a project where ci cd security was part of your work. What did you do?
Tell me about a project where code review was part of your work. What did you do?
Tell me about a project where owasp was part of your work. What did you do?

Adapt your resume

List these exact terms on your resume: Application Security, Threat Modeling, Ci Cd Security, Code Review, and Owasp. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.

Get your CV reviewed before you apply

Send your CV and the role you want next. Your review arrives by email within 3 days.

Get a free CV review Check your resume with the ATS resume checker