Application Security Specialist at BP Fuel Garage

Kuala Lumpur, Kuala Lumpur, Malaysia -

Full Time

Start Date

Immediate

Expiry Date

09 Jan, 26

Salary

0.0

Posted On

11 Oct, 25

Experience

5 year(s) or above

Remote Job

Yes

Telecommute

Yes

Sponsor Visa

Skills

Application Security, API Security, Cybersecurity, Secure Coding, Threat Modeling, DevSecOps, Vulnerability Scanning, Incident Management, Cloud Environments, Programming, Security Testing, Risk Management, Compliance, Data Analytics, Technical Documentation, Stakeholder Management

Industry

Oil and Gas

Description

Entity: Technology Job Family Group: IT&S Group Job Description: You will work with This team drives the response and management of cyber incidents, using an intelligence-led approach for identification, mitigation, and rapid response to safeguard bp on a global scale. By applying lessons learned and data analytics, they establish engineering principles and enhance the technology stack to continuously bolster bp's cybersecurity posture. Let me tell you about the role We are looking for Information Security Engineering Specialist (Application Security) who will be accountable to design, implement, monitor, and maintain robust API security processes, policies, and tools as you work closely with the software engineering team in development, architecture, operations and embedding security best practices and standards such as OWASP, REST/SOAP, authentication/authorization models. So, we can adapt quickly, demonstrate the latest technology, and scale our solutions globally. You will advocate that application development, platform development, and infrastructure teams adhere to secure design and development practices (e.g., threat modeling, technical design review, resilience testing, monitoring & alerting, code review, and documentation) You will also contribute to standard processes that will help shape bp’s security agenda and create a culture of excellence. What you will deliver Provide technical expertise in support of information security and risk activities specific to the specialism to achieve objectives e.g. designing and developing security solutions to work across bp’s digital environments that are consistent with current policies. Maintain and improve API security controls and practices across the SDLC to help software engineering teams create products secure by design. Perform security reviews of API designs, specifications (e.g. Open API / Swagger), and source code to identify and remediate vulnerabilities Develop and promote guidelines for secure API and cloud-native applications. Maintain systems that are designed to uncover code vulnerabilities and provide remediation insights. Integrate security processes, such threat modeling. Collaborate with DevOps/CI/CD teams to shift left on security: integrate API security testing (static & dynamic), automated vulnerability scanning, and policy enforcement into the pipeline Enforce secure design patterns for APIs (including REST, SOAP) and advocate for least privilege, data minimization, segmentation of access. Deliver the implementation and application of relevant operating processes and procedures, and ensure all activities adhere to the relevant standards. Monitor and maintain logging, alerting, and telemetry for APIs; respond to incidents, API misuse, and anomalous behavior. Create and maintain API security standards, policies, and guidelines. Evolve the security roadmap to meet anticipated future requirements and needs. Create and articulate materials on how to embed and measure security throughout the software and platform development lifecycle. Develop and maintain a series of internal and external collaborator relationships, delivering advanced technical knowledge to support project delivery, cooperatively identify key challenges and ensure that security solutions successfully protect bp against cyber risks. What you will need to be successful (experience and qualifications) Seasoned security professional with 5+ years delivering security engineering services and/or building security solutions within a complex organization with hands‑on experience in application security, API security or related field is preferred. Firm foundation of information and cyber security principles and standard processes. Solid knowledge in application security concepts (OWASP Top 10, secure coding best practices, common vulnerabilities, etc). Experience with API Gateways & related tooling (e.g. AWS API Gateway, Azure API Management) Proficiency in security testing tools such as Postman, Insomnia Familiarity with secure coding practices and API specification review (OpenAPI / Swagger). Professional and technical security certifications such as CISSP, CISM, GEVA, CEH, OSCP or equivalent are a plus. Development experience in one or more object-oriented programming languages (e.g., Python, Scala, Java, C#) and/or cloud environments (including AWS, Azure, Alibaba, etc.) Familiarity with containerization, microservices architecture, and orchestration tools (Kubernetes) Practical experience with code scanning tools (SAST, DAST, SCA) Experience with CI/CD pipelines and DevSecOps tools to automate security checks and integrate them into the development workflow. Operational proficiency in frameworks such as CIS CSC, NIST CSF, NIST 800-53, ISO 27001, etc. Strong analytical skills such as having ability to interpret scan reports and produce actionable remediation plans. Excellent communication skills; able to explain technical risks to non‑technical stakeholders. Foundational knowledge of security standards, industry laws, and regulations such as Payment Card Industry Data Security Standards (PCI-DSS), General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) and Sarbanes-Oxley (SOX) Continuous learning and improvement approach About bp bp is a global energy business with a purpose to reimagine energy for people and our planet. We aim to be a very different kind of energy company by 2030, helping the world reach net zero and improving people’s lives. We are committed to creating a diverse and inclusive environment where everyone can grow and succeed. Join bp and become part of the team building our future! We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform crucial job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation. Travel Requirement No travel is expected with this role Relocation Assistance: This role is not eligible for relocation Remote Type: This position is a hybrid of office/remote working Skills: Automation system digital security, Client Counseling, Conformance review, Digital Forensics, Incident management, incident investigation and response, Information Assurance, Information Security, Information security behaviour change, Intrusion detection and analysis, Legal and regulatory environment and compliance, Risk Management, Secure development, Security administration, Security architecture, Security evaluation and functionality testing, Solution Architecture, Stakeholder Management, Supplier security management, Technical specialism Legal Disclaimer: We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, socioeconomic status, neurodiversity/neurocognitive functioning, veteran status or disability status. Individuals with an accessibility need may request an adjustment/accommodation related to bp’s recruiting process (e.g., accessing the job application, completing required assessments, participating in telephone screenings or interviews, etc.). If you would like to request an adjustment/accommodation related to the recruitment process, please contact us. If you are selected for a position and depending upon your role, your employment may be contingent upon adherence to local policy. This may include pre-placement drug screening, medical review of physical fitness for the role, and background checks. We aim to be a very different kind of energy company by 2030 as we scale up investment in low-carbon, focus our oil and gas production and make headway on reducing emissions. Our new strategy kickstarts a decade of delivery towards our #bpNetZero ambition.

How To Apply:

Incase you would like to apply to this job directly from the source, please click here

Responsibilities

You will design, implement, monitor, and maintain robust API security processes and tools while collaborating with software engineering teams. Your role includes performing security reviews, integrating security processes, and advocating for secure design practices.