Application Security Engineer

MetaComp Pte Ltd is a leading Singapore-based digital payment solution provider, licensed and regulated by the Monetary Authority of Singapore (MAS) as a Major Payment Institution, to provide Digital Payment Token Services and Cross-border Payment Transfers. Operating under a P2B2C (platform-to-business, partners-to-clients) model, MetaComp provides its clients with an integrated end-to-end suite of services, empowering them to confidently enter the digital asset market with much-needed safety, security, and compliance assurance. Together with its parent company, Metaverse Green Exchange Pte. Ltd. (a MAS-licensed CMS holder permitted to carry out, inter alia, brokerage and custody services), MetaComp introduces its suite of services through CAMP (Client Assets Management Platform) which allow businesses to develop and scale their digital asset offerings through various products and/or services such as over-the-counter transactions, fiat payments, digital asset custody and prime brokerage.

Sets the security requirements for our applications and reviews every significant change before it ships, from feature releases to major refactoring. The focus is business logic: our platforms handle payments and digital assets, so the flaws that matter most involve money movement. Developers own the fixes: this role sets the bar, finds the issues and verifies they are fixed. Hands-on individual contributor role.

• Set the security requirements for our applications: what new features, APIs and services must meet before release (e.g. authentication, authorisation, input validation, secrets handling, logging, money-movement controls).
• Review changes before they ship, from feature releases to major refactoring and re-architecture: threat model the design, review the code and test the change, then sign off or name what must be fixed first. Changes touching payments, payouts, balances or authentication get the deepest review, covering authorisation, request signing and replay protection, money-movement logic and cryptography.
• Test our applications for business-logic flaws, such as race conditions and double spends, amount tampering, broken authorisation, payout and withdrawal abuse, and request replay.
• Set the standard for application security scanning in CI (SAST, DAST, SCA, secrets scanning): which scans run, which findings block a merge, and exceptions for high and critical findings. Tune the rules so developers fix most findings themselves; the CI/CD platform itself is secured by our cloud infrastructure security engineer.
• For new services and significant changes, review how apps use cloud IAM roles, secrets and infrastructure as code: least privilege, no hard-coded or long-lived credentials, no unintended exposure.
• Reproduce payment-abuse cases flagged by our risk team that may have a security cause; confirm whether a code or design fix is needed.
• Hand findings to the owning developers with clear fix guidance, track them to closure, and retest before closing.
• Respond hands-on to application and payment incidents as the area expert.
• Keep security requirements, review sign-offs, test reports, scan results and fix records as audit evidence.

• At least 4 years of hands-on web and API security work in application security, product security, penetration testing or full-time bug bounty research.
• Has taken web app or API security issues from discovery to verified closure, working with the developers who fixed them (in-house, consultancy or bug bounty).
• Programs in Python and Java: Python for security testing and automation (e.g. race-condition scripts), Java (Spring Boot) for reading and reviewing backend code and giving developers clear fix guidance.
• Has learned an adjacent skill and applied it to security work (e.g. cloud, CI tooling, infrastructure as code).
• Explains security requirements and review findings clearly to developers and product owners, and holds the line on what must be fixed before release.
• Works independently and owns an area end to end.
• Checks their own work and stands behind it; uses AI tools to go faster, but understands and verifies the output.

• Security requirements and change review: has written security requirements for applications and reviewed features, releases or re-architecture before they shipped.
• Business logic: has found and reported flaws in multi-step transactional flows (e.g. checkout, booking, account, balance).
• Manual testing: has tested web apps and APIs with an intercepting proxy and found issues scanners missed.
• OWASP: applies the Top 10 and API Security Top 10 in testing and code review.
• API authentication and signing: has reviewed or tested schemes, e.g. OAuth