Sr. Software Engineer (SDE-3 DevOps & Security)

<p><span style="font-family:Arial;font-size:14px;"><b>About Pluang<br /></b></span><br /><span style="font-family:Arial;font-size:14px;">Pluang is Indonesia’s leading multi-asset investment platform, offering products such as Crypto, US stocks, </span><span style="font-family:Arial;font-size:14px;">mutual funds, and gold. At Pluang, we’re on a mission to redefine the way people invest. As one of the </span><span style="font-family:Arial;font-size:14px;">fastest-growing fintech platforms in Indonesia, we empower users to achieve financial independence </span><span style="font-family:Arial;font-size:14px;">through a seamless, innovative, and secure investment experience. </span><span style="font-family:Arial;color:rgb(17,85,204);font-size:14px;">Explore more about us here!</span><br /><b><br /><span style="font-family:Arial;"><span style="font-size:14px;">Job Role<br /></span><br /></span></b><span style="background-color:transparent;color:rgb(0,0,0);font-family:Arial, sans-serif;font-size:14px;white-space:pre-wrap;text-align:justify;">Pluang is hiring a Senior Security Engineer to build and run core parts of security engineering for our regulated fintech platform, which serves millions of users across Indonesia in stocks, crypto, gold and other assets.</span></p><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">This is a senior, hands-on individual-contributor role. You will own four areas end to end: cloud and Kubernetes security, secure SDLC and supply chain, vulnerability management at scale, and security partnership with our asset-class product squads. You will also contribute to application security, detection and incident response, and AI security, and mentor other engineers on the team.</span></p><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">You will join a mature program, with automated pipeline security, policy-as-code admission control, centralised logging and detection, a public bug-bounty program and ISO 27001 certification, and you will be expected to make it measurably better.</span></p><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">What you will inherit </span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">An established program with controls as code, GitOps delivery and ISO 27001 certification, on a modern stack spanning AWS, GCP, Kubernetes, policy-as-code, runtime detection and in-house AI-assisted security tooling, including agentic penetration testing.</span></p><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Where we are investing</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> Three priorities will define the security function over the next twelve months, and this role will help shape each of them.</span></p><ul style="margin-top:0;margin-bottom:0;"><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">AI agent security:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> guardrails, testing and access controls that make AI agents safe before they reach production.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Security 360:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> a continuous, company-wide view of security posture, with clear ownership of every gap.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Organisation-wide security:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> protection that extends beyond infrastructure to SaaS, endpoints and every engineering team.</span></p></li></ul><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">How you will grow </span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Your scope expands with your impact. As these initiatives mature, you will take on broader ownership and greater technical leadership.</span></p><p><span style="font-family:Arial;font-size:14px;"><b>What You Will Do</b></span></p><ul><li><span id="docs-internal-guid-2243fafe-7fff-09fc-f7b9-545e3cddedc9"></span><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Primary ownership</span></p><ul><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Cloud and Kubernetes security:</span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;"> Own the security posture of our AWS and GCP environments and Kubernetes clusters: least privilege, workload identity, base-image hardening, admission policies, runtime detection and network segmentation, all deployed through GitOps.</span></p></li><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Secure SDLC and supply chain:</span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;"> Run and extend automated security testing in CI/CD . Protect build infrastructure and artifacts, and keep findings flowing to service owners rather than piling up in dashboards.</span></p></li><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:12pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Vulnerability management at scale:</span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;"> Own the full lifecycle of findings from scanners, pentests and our bug-bounty program. Fix at the source with hardened base images, secure paved-road templates and shared libraries, so one fix closes a whole class of findings. </span></p></li></ul><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Contribution areas</span></p><ul><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Application & API security: </span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Conduct threat modeling, secure design reviews, and penetration testing across web, API, and mobile platforms, focusing on authentication, OWASP Top 10, and fraud/business-logic risks in financial flows.</span></p></li><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Third-party integrations: </span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Secure integrations with exchanges, liquidity providers, custodians, and payment gateways through robust API key management, callback verification, and vendor security reviews.</span></p></li><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Detection & incident response: </span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Develop detection rules, triage alerts, participate in the on-call rotation, and lead incident containment and post-incident reviews.</span></p></li><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">AI security: </span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Implement data access controls, prompt-injection safeguards, and production guardrails for LLM features and AI agents, while enhancing internal AI-driven security tools.</span></p></li><li dir="ltr" style="font-size:11pt;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:12pt;"><span style="font-size:14px;background-color:transparent;font-weight:700;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Mentorship: </span><span style="font-size:14px;background-color:transparent;font-variant:normal;vertical-align:baseline;white-space:pre-wrap;">Coach engineers, conduct code/design reviews, and drive adoption of secure-by-default architecture across engineering teams.</span></p></li></ul></li></ul><p><span style="font-family:Arial;font-size:14px;"><b>What We’re Looking For</b></span></p><ul style="margin-top:0;margin-bottom:0;"><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Experience:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> 5+ years in security engineering, at least 3 of them hands-on in cloud, platform or DevSecOps security in production, including mentoring other engineers and explaining risk to engineers, auditors and leadership.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Kubernetes security:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> RBAC, network policies, admission controllers and runtime detection in live clusters.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Cloud security :</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> IAM least-privilege design, workload identity, account and network hardening, and infrastructure as code. Deep experience in one cloud and working knowledge of the other.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">CI/CD and supply-chain security:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> Implement and operate SAST, SCA, container scanning, secrets management and SBOMs in real pipelines, and you understand GitOps.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Vulnerability management at scale:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> risk-based triage and prioritisation, SLA management and automating remediation workflows across many teams, not just running scanners.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Cross-team influence:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> a track record of driving security outcomes across many engineering teams you don't manage, by prioritising, negotiating fixes and influencing without authority.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Coding:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> you write production-quality Python or Go to build security tooling and automation.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Incident response:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> you have worked a real security incident and can lead one in your domain to closure, including the post-incident review.</span></p></li></ul><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">If you match most of these but not all, apply anyway. We hire for depth and judgement, not checklists.</span></p><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"><br /></span><span style="background-color:transparent;color:rgb(0,0,0);font-family:Arial, sans-serif;font-weight:700;white-space:pre-wrap;">Nice to have</span></p><ul style="margin-top:0;margin-bottom:0;"><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Application and API security depth:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> threat modelling, API authorisation and business-logic testing.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Detection engineering:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> building and tuning SIEM.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Offensive security:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> OSCP or equivalent, or pentest or red-team experience that shapes how you build defences.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Bug bounty:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> running a program on YesWeHack, HackerOne, Bugcrowd or similar.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">AI and LLM security:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> OWASP LLM Top 10, prompt-injection testing, securing AI agents, or building LLM-based security tooling.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Identity engineering:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> SSO and SCIM rollouts, IdP consolidation or zero-trust access migrations.</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:0pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Certifications:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> AWS Certified Security – Specialty, Google Cloud Professional Cloud Security Engineer or Certified Kubernetes Security Specialist (CKS).</span></p></li><li dir="ltr" style="list-style-type:disc;font-size:11pt;font-family:Arial, sans-serif;color:#000000;background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre;"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:0pt;margin-bottom:12pt;"><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;">Regulated-industry experience:</span><span style="font-size:14px;font-family:Arial, sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:400;font-style:normal;font-variant:normal;text-decoration:none;vertical-align:baseline;white-space:pre-wrap;"> fintech, crypto or similar, including ISO 27001, SOC 2 or PCI-DSS, ITGC/ITAC audits, custody and key management, or regulator interactions.</span></p></li></ul><p></p><p dir="ltr" style="line-height:1.38;text-align:justify;margin-top:12pt;margin-bottom:0pt;"><span style="font-family:Arial;font-size:14px;">We are an equal-opportunity employer and value diversity at our company. We do not discriminate based </span><span style="font-family:Arial;font-size:14px;">on race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or </span><span style="font-family:Arial;font-size:14px;">disability status.</span></p><p><br /><span style="font-family:Arial;font-size:14px;">Want the inside scoop on our culture, the interview process, and the amazing team at Pluang? </span><i><span style="font-family:Arial;color:rgb(17,85,204);font-size:14px;">Click here to </span><span style="font-family:Arial;color:rgb(17,85,204);font-size:14px;">find out!</span><br /></i><br /><span style="font-family:Arial;font-size:14px;">Curious about what it’s like to work with us? Get a glimpse of life at Pluang through the eyes of our team! </span><span style="font-family:Arial;color:rgb(17,85,204);font-size:14px;"><i>Check out our Instagram!</i></span></p>