Cybersecurity Engineer (Application Security - AI Assurance)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of GovTech, is hiring a Cybersecurity Engineer focused on application security and AI assurance. The role builds AI-assisted workflows that support Threat-Risk Assessments (TRAs), centralises code scanning and white-box testing, and creates secure tool integrations for the CISO team.

Key responsibilities

• Build an AI-assisted workflow that generates draft threat scenarios for TRAs from product information, prior assessments, threat patterns and a security knowledge base, with human review first.
• Create and maintain the security second brain, curating threat scenarios, attack techniques, patterns, assessments and lessons with reliable sources and metadata.
• Centralise code scanning and white-box testing across repositories and pipelines, integrating static analysis, dependency checks and secrets detection, and help teams triage and fix findings.
• Maintain a knowledge base for recurring Vulnerability Disclosure Programme issues, tracking reduced recurrence as a KPI.
• Develop a controlled auto-patching workflow for penetration-test findings, mapping them to code, generating fixes or pull requests and validating them.
• Work with the Application Security lead, penetration testers and product engineers to validate findings and improve assurance outcomes.
• Create an MCP service for the CISO team with authentication, authorisation, input validation, logging and human approval points.
• Define evaluation methods and test suites for AI-assisted workflows, measuring false positives, missed issues and unsafe actions.
• Turn prototypes into maintainable services with version control, testing, deployment, monitoring and documentation.

Required profile

• Hands-on experience in application security, security engineering, penetration testing, secure software development or vulnerability research.
• Experience with code scanning, white-box testing, static analysis, dependency or secrets checking, secure code review and CI/CD pipelines.
• Experience building or running AI applications, agents or workflow automation with large language models, tool calling and retrieval.
• Ability to investigate and validate security findings and design secure tool integrations with approval gates and least-privilege access.
• Strong written communication explaining technical findings and residual risk to security practitioners and product teams.

Required skills

• Semgrep, CodeQL, SonarQube, Snyk, Checkmarx or comparable tools.
• Retrieval-augmented generation, embeddings, vector search, knowledge graphs and technical security knowledge bases.
• MCP, tool gateways, agent registries, Docker, AWS or other major cloud platforms.
• Python and API integration; strong programming and automation ability.

What we offer

• A wholly-owned subsidiary of GovTech.
• A learning culture with growth opportunities.
• Contract staff enjoy the same benefits as permanent employees.