Cybersecurity Lead (Cloud)
Lead application and cloud security for a business-critical AWS platform modernisation programme in Kuala Lumpur, on-site with a government/enterprise client: threat modelling, SSDLC, identity and access controls, VAPT coordination, compliance evidence, and mentoring a security analyst.
- Compensation
- Not disclosed
- Location
- Kuala Lumpur
- Work setup
- Onsite
- Seniority
- Lead
- Employment
- Full time
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- 10+ years in information security, with at least 5 years in application or cloud security on enterprise systems
- Hands-on AWS security experience (IAM, KMS, WAF, GuardDuty, Security Hub or equivalent)
- Strong knowledge of OWASP Top 10 and ASVS, threat modelling and secure coding for Java web applications
- Experience leading VAPT cycles and remediation with development teams
- Experience aligning systems with security frameworks (e.g. ISO 27001, NIST CSF) and supporting audits
- Professional certification such as CISSP, CCSP, CISM or AWS Certified Security – Specialty
Nice to have
- Security work in financial services, regulated industries or government
- Knowledge of Malaysian technology risk and data protection requirements (e.g. PDPA)
- OSCP or other offensive security certification
Full description
About Neutron and the project
Neutron is a Singapore technology company that builds and runs mission-critical digital platforms for government, regulated industries and large enterprises. We are building a delivery team in Kuala Lumpur for a large-scale platform modernisation programme.
The programme replaces a long-running legacy system with a cloud-native platform on AWS, with configurable workflows, a new user experience and integration with external systems. It is a multi-year engagement covering delivery and post-go-live support.
These roles are full-time, based in Kuala Lumpur and on-site with the client. The start date is subject to project confirmation.
About the role
You will make sure a business-critical platform handling confidential information is secure by design, and demonstrate it to a client with high security and compliance standards.
Key responsibilities
- Own application and solution security across the delivery lifecycle, from design through go-live.
- Lead threat modelling and security architecture reviews for the cloud-native platform on AWS.
- Define and enforce secure development practices (SSDLC), including code review standards, SAST, DAST and dependency scanning in CI/CD.
- Specify identity and access controls: MFA, SSO, role-based access, privileged access and session management.
- Define encryption, key management, secrets handling, logging, audit trail and security monitoring requirements.
- Coordinate vulnerability assessment and penetration testing (VAPT), track remediation and sign off security readiness.
- Map controls to client security standards and applicable regulatory requirements, and prepare evidence for audits.
- Work with the cloud and DevOps team on infrastructure security, and lead security incident response planning for go-live.
- Mentor a security analyst and raise security awareness across the development team.
About you
- 10+ years in information security, with at least 5 years in application or cloud security on enterprise systems.
- Hands-on AWS security experience (IAM, KMS, WAF, GuardDuty, Security Hub or equivalent).
- Strong knowledge of OWASP Top 10 and ASVS, threat modelling and secure coding for Java web applications.
- Experience leading VAPT cycles and remediation with development teams.
- Experience aligning systems with security frameworks (e.g. ISO 27001, NIST CSF) and supporting audits.
- Professional certification such as CISSP, CCSP, CISM or AWS Certified Security – Specialty.