Lead Application Security Engineer

Agoda is hiring a Lead Application Security Engineer to join its Security Department in Bangkok, Thailand, supporting security, compliance, and security operations across the company. The role sits in a fast-paced DevSecOps environment and focuses on integrating security testing into continuous deployment and integration flows, while performing design reviews, code review, and remediation at scale.

The position requires strong software engineering foundations with at least 7 years of technical experience across areas such as threat modeling, secure coding, authentication, and network security, plus hands-on cloud and SDLC experience. Candidates are expected to work with microservices, web, and mobile platforms across on-premise and public cloud data centers.

Play a lead role in developing and designing application-level security controls and standards

Perform application security design reviews against new products and services

Track and prioritize all security issues

Build internal security tools that help fix security problems at scale

Perform code review and drive remediation of discovered issues

Strong foundations in software engineering

Minimum 7 years of technical experience in threat modeling, secure coding, identity management and authentication, software development, cryptography, system administration and network security

Minimum 2 years SDLC experience in languages such as Rust, Python, Go, or Node.js

Minimum 1 year experience with public/private cloud environments (Openshift, Rancher, K8s, AWS, GCP, Azure)

In-depth knowledge of common web application vulnerabilities such as OWASP Top 10