Cybersecurity Engineer (Application Security - AI Assurance)

Assurity Trusted Solutions (ATS) is a wholly owned subsidiary of the Government Technology Agency (GovTech). As a Trusted Partner over the last decade. ATS offers a comprehensive suite of products and services ranging from infrastructure and operational services, governance and assurance services as well as managed processes. In a dynamic digital & cyber landscape where trust & collaboration is key, ATS continues to drive mutually beneficial business outcomes through collaboration with GovTech, government agencies and commercial partners to mitigate cyber risks and bolster security postures.

Responsibilities:

• Build an AI-assisted workflow that generates draft threat scenarios for Threat-Risk Assessments (TRAs) from product information, prior assessments, threat patterns and the security second brain. Design the workflow for human review first, with a path towards generating more complete TRA content as reliability improves.
• Create and maintain the security second brain that supports TRA work. Curate threat scenarios, attack techniques, security patterns, prior assessments, product context and review lessons with reliable sources, useful metadata, traceability and clear handling of outdated or unreliable content.
• Build centralised code-scanning and white-box testing capabilities across source-code repositories and delivery pipelines to identify security bugs early. Integrate static analysis, dependency checks, secrets detection and other suitable checks, then help teams triage and fix meaningful findings.
• Create a separate knowledge base for recurring Vulnerability Disclosure Programme (VDP) issues. Analyse historical findings, identify repeated weaknesses and root causes, map them to coding patterns and preventive controls, and track measurable reduction in recurrence as a key performance indicator.
• Develop a controlled auto-patching workflow for vulnerabilities identified in penetration-test reports. Map findings to affected code or components, generate fixes or pull requests, run tests and security checks, validate that the finding is addressed, and work towards automatically applying safe fixes through a governed pipeline.
• Work closely with the Application Security lead, penetration tester and product engineers to validate findings, assess exploitability, review generated fixes and improve the quality of assurance outcomes.
• Create an MCP service for the CISO team so that approved internal tools can be called through a consistent and secure interface. Define authentication, authorisation, input validation, logging, error handling, data boundaries and human approval points for consequential actions.
• Build evaluation methods and test suites for AI-assisted assurance workflows. Measure the quality of generated TRA scenarios, code findings, proposed patches and tool calls, including false positives, missed issues, unsafe actions and cases requiring human intervention.
• Turn prototypes into maintainable services and reusable components with version control, testing, deployment, monitoring, documentation and operational support.
• Document security assumptions, limitations, residual risks and operating procedures. State clearly when an automated result is advisory, incomplete or unsuitable for direct action.