jobapplier

Sr. Software Engineer (SDE-3 DevOps & Security)

Pluang

Pluang is hiring a Senior Security Engineer to build and run core parts of security engineering for our regulated fintech platform, which serves millions of users across Indonesia in stocks, crypto, gold and other assets. This is a senior, hands-on individual-contributor role. You will own four areas end to end: cloud and Kubernetes security, secure SDLC and supply chain, vulnerability management at scale, and security partnership with our asset-class product squads.

About Pluang

  • Pluang Pluang is Indonesia’s leading multi-asset investment platform, offering products such as Crypto, US stocks, mutual funds, and gold.
  • At Pluang, we’re on a mission to redefine the way people invest.
  • As one of the fastest-growing fintech platforms in Indonesia, we empower users to achieve financial independence through a seamless, innovative, and secure investment experience.
  • Explore more about us here!
  • protection that extends beyond infrastructure to SaaS, endpoints and every engineering team.
  • How you will grow Your scope expands with your impact.
  • As these initiatives mature, you will take on broader ownership and greater technical leadership.
  • OWASP LLM Top 10, prompt-injection testing, securing AI agents, or building LLM-based security tooling.
  • Want the inside scoop on our culture, the interview process, and the amazing team at Pluang?
  • Click here to find out!
  • Get a glimpse of life at Pluang through the eyes of our team!
  • Check out our Instagram!

Responsibilities

  • You will also contribute to application security, detection and incident response, and AI security, and mentor other engineers on the team.
  • You will join a mature program, with automated pipeline security, policy-as-code admission control, centralised logging and detection, a public bug-bounty program and ISO 27001 certification, and you will be expected to make it measurably better.
  • What you will inherit An established program with controls as code, GitOps delivery and ISO 27001 certification, on a modern stack spanning AWS, GCP, Kubernetes, policy-as-code, runtime detection and in-house AI-assisted security tooling, including agentic penetration testing.
  • Where we are investing Three priorities will define the security function over the next twelve months, and this role will help shape each of them.
  • guardrails, testing and access controls that make AI agents safe before they reach production.
  • Security 360: a continuous, company-wide view of security posture, with clear ownership of every gap.
  • You Will Do Primary ownership Cloud and Kubernetes security: Own the security posture of our AWS and GCP environments and Kubernetes clusters: least privilege, workload identity, base-image hardening, admission policies, runtime detection and network segmentation, all deployed through GitOps.
  • Run and extend automated security testing in CI/CD .
  • Protect build infrastructure and artifacts, and keep findings flowing to service owners rather than piling up in dashboards.
  • Own the full lifecycle of findings from scanners, pentests and our bug-bounty program.
  • Fix at the source with hardened base images, secure paved-road templates and shared libraries, so one fix closes a whole class of findings.
  • Conduct threat modeling, secure design reviews, and penetration testing across web, API, and mobile platforms, focusing on authentication, OWASP Top 10, and fraud/business-logic risks in financial flows.
  • Secure integrations with exchanges, liquidity providers, custodians, and payment gateways through robust API key management, callback verification, and vendor security reviews.
  • Develop detection rules, triage alerts, participate in the on-call rotation, and lead incident containment and post-incident reviews.
  • Implement data access controls, prompt-injection safeguards, and production guardrails for LLM features and AI agents, while enhancing internal AI-driven security tools.
  • Coach engineers, conduct code/design reviews, and drive adoption of secure-by-default architecture across engineering teams.
  • 5+ years in security engineering, at least 3 of them hands-on in cloud, platform or DevSecOps security in production, including mentoring other engineers and explaining risk to engineers, auditors and leadership.
  • RBAC, network policies, admission controllers and runtime detection in live clusters.
  • risk-based triage and prioritisation, SLA management and automating remediation workflows across many teams, not just running scanners.
  • you have worked a real security incident and can lead one in your domain to closure, including the post-incident review.

Requirements

  • IAM least-privilege design, workload identity, account and network hardening, and infrastructure as code.
  • Deep experience in one cloud and working knowledge of the other.
  • Implement and operate SAST, SCA, container scanning, secrets management and SBOMs in real pipelines, and you understand GitOps.
  • a track record of driving security outcomes across many engineering teams you don't manage, by prioritising, negotiating fixes and influencing without authority.
  • you write production-quality Python or Go to build security tooling and automation.
  • Nice to have Application and API security depth: threat modelling, API authorisation and business-logic testing.
  • building and tuning SIEM.
  • SSO and SCIM rollouts, IdP consolidation or zero-trust access migrations.
  • AWS Certified Security – Specialty, Google Cloud Professional Cloud Security Engineer or Certified Kubernetes Security Specialist (CKS).

Preferred

  • OSCP or equivalent, or pentest or red-team experience that shapes how you build defences.

Benefits

  • running a program on YesWeHack, HackerOne, Bugcrowd or similar.

Incident response

If you match most of these but not all, apply anyway. We hire for depth and judgement, not checklists.

Regulated-industry experience

fintech, crypto or similar, including ISO 27001, SOC 2 or PCI-DSS, ITGC/ITAC audits, custody and key management, or regulator interactions. We are an equal-opportunity employer and value diversity at our company. We do not discriminate based on race, religion, colour, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.

Curious about what it’s like to work with us?