Cybersecurity Lead (Cloud)
Summary
Lead application and cloud security for a business-critical AWS platform modernisation programme in Kuala Lumpur, on-site with a government/enterprise client: threat modelling, SSDLC, identity and access controls, VAPT coordination, compliance evidence, and mentoring a security analyst.
About Neutron and the project
Neutron is a Singapore technology company that builds and runs mission-critical digital platforms for government, regulated industries and large enterprises. We are building a delivery team in Kuala Lumpur for a large-scale platform modernisation programme.
The programme replaces a long-running legacy system with a cloud-native platform on AWS, with configurable workflows, a new user experience and integration with external systems. It is a multi-year engagement covering delivery and post-go-live support.
These roles are full-time, based in Kuala Lumpur and on-site with the client. The start date is subject to project confirmation.
About the role
You will make sure a business-critical platform handling confidential information is secure by design, and demonstrate it to a client with high security and compliance standards.
Key responsibilities
Own application and solution security across the delivery lifecycle, from design through go-live.
Lead threat modelling and security architecture reviews for the cloud-native platform on AWS.
Define and enforce secure development practices (SSDLC), including code review standards, SAST, DAST and dependency scanning in CI/CD.
Specify identity and access controls: MFA, SSO, role-based access, privileged access and session management.
Define encryption, key management, secrets handling, logging, audit trail and security monitoring requirements.
Coordinate vulnerability assessment and penetration testing (VAPT), track remediation and sign off security readiness.
Map controls to client security standards and applicable regulatory requirements, and prepare evidence for audits.
Work with the cloud and DevOps team on infrastructure security, and lead security incident response planning for go-live.
Mentor a security analyst and raise security awareness across the development team.
About you
10+ years in information security, with at least 5 years in application or cloud security on enterprise systems.
Hands-on AWS security experience (IAM, KMS, WAF, GuardDuty, Security Hub or equivalent).
Strong knowledge of OWASP Top 10 and ASVS, threat modelling and secure coding for Java web applications.
Experience leading VAPT cycles and remediation with development teams.
Experience aligning systems with security frameworks (e.g. ISO 27001, NIST CSF) and supporting audits.
Professional certification such as CISSP, CCSP, CISM or AWS Certified Security – Specialty.
Security work in financial services, regulated industries or government.
Knowledge of Malaysian technology risk and data protection requirements (e.g. PDPA).
OSCP or other offensive security certification.