Lead Systems Engineer - Application Security Architect

About the role

Singapore Airlines is looking for a Lead Systems Engineer (Application Security Architect) to join its Information Technology Division. The role covers application security reviews, threat modelling, identity and access security, and the security of AI-enabled applications.

Key responsibilities

• Lead security architecture reviews and threat modelling for applications, platforms and technology initiatives, and assess authentication and authorization flows including OAuth 2.0, OpenID Connect and JWT.
• Review AI deployment architectures such as RAG, MCP integrations and agent workflows, and help improve AI threat modelling and pilot cybersecurity delivery.
• Mentor security consultants and engineering teams, embed security-by-design practices and support security tooling adoption.
• Revitalize the Security Champions programme through training and knowledge sharing.
• Design identity integration patterns for hybrid and multi-cloud environments and support identity governance, access lifecycle management and least privilege.
• Contribute to security blueprints and guardrails for generative AI, including prompt injection, data exposure and authorization controls.

Required profile

• Bachelor's degree in computer science, engineering or a related field, or equivalent practical experience.
• 5+ years of experience in software engineering, solution architecture or application security.
• Experience delivering security or architecture improvements across multiple stakeholders.
• Strong communication skills and the ability to explain security risks and trade-offs to technical and business stakeholders.

Required skills

• Application security principles, including OWASP guidance, secure coding, API security and authentication and authorization.
• Security tooling in development workflows such as SAST, DAST, software composition analysis, container scanning and secrets management.
• Cloud security and identity patterns in AWS, Azure or comparable environments.
• Familiarity with LLMs, RAG, MCP or agentic AI; deep expertise not required.
• Beneficial: Security Champions programme experience, reusable security patterns, identity governance, and certifications such as GIAC/SANS or AWS/Azure security certifications.