Tentang pekerjaan
Tanggung Jawab:
- Build and run Jubelio's security function as the first dedicated Security Engineer, reporting to the VP of Technology.
- Perform threat modelling across applications, infrastructure, repositories and third-party integrations, and turn the results into a prioritised list of what to patch first.
- Own security risk scoring and the risk register, so that severity reflects real business impact.
- Triage and validate findings from vulnerability scanners, SIEM alerts, code scanning and external reports, and escalate only what matters.
- Analyze monthly security reports and turn them into clear decisions and actions for engineering and management.
- Handle security incidents end to end: detection, containment, investigation and post-incident improvements.
- Review code and architecture for security risks, and work with developers to fix them.
- Define security standards and frameworks (secure development, secrets, access, vulnerability management) that engineers can follow.
- Decide which areas need penetration testing, scope the work with external vendors, challenge their reports and verify the fixes.
- Work with GRC so that security controls and evidence meet compliance requirements.
- Coordinate with DevOps and development squads, who own remediation under our agreed SLA.
Kualifikasi:
- Bachelor's degree in Computer Science, Information Security, Engineering, or a related field, or equivalent experience.
- Minimum 3 years of experience in security engineering, AppSec, DevSecOps or a similar role.
- Hands-on experience in threat modelling (STRIDE, attack trees or similar) on real systems.
- Able to read code and review pull requests for security issues in at least one of: Go, NodeJS, or TypeScript.
- Experience with cloud and container security, preferably Kubernetes (RBAC, network policy, secrets management).
- Experience handling real security incidents and writing post-incident reviews.
- Experience with vulnerability management and security monitoring, including SIEM, vulnerability scanners and SAST/SCA tools.
- Strong risk judgment: able to prioritise by real exploitability and business impact, not only CVSS scores.
- Experience scoping and managing penetration tests with external vendors is an advantage.
- Knowledge of compliance frameworks (ISO 27001, SOC 2, NIST Cybersecurity) is an advantage.
- Good communicator who can influence engineers without formal authority. Fluent in English and Bahasa Indonesia.
- Comfortable building from zero, with a strong sense of ownership. You will be the only security engineer at first.
- Certifications such as OSCP, OSWE, CKS or CISSP are a plus, but demonstrated experience matters more.