Why Coda
Coda is a global growth engine for commerce, connecting people, digital products, and payments through trusted monetization and distribution solutions.
With 600+ people from 57 nationalities across 23 locations, we’re a truly global team headquartered in Singapore, with offices in Amsterdam, Dubai, Bristol, Shanghai, Eindhoven, and across Southeast Asia.
We power global commerce through a dual model. Our B2B solutions, Codapay, Coda Webstore, Coda Links, Coda Distribution, and Giftcloud, enable publishers and brands to monetize and distribute digital content globally. On the consumer side, we operate a portfolio of trusted storefronts including Codashop, Recharge.com, Startselect.com, and mobiletopup.co.uk, that give customers secure and easy access to game top-ups, digital credits, vouchers, gift cards and prepaid products in over 70 markets.
Our culture is built on respect, ownership, and collaboration. We move fast, support each other, and celebrate wins together.
If you’re looking to grow your career and make a real impact in a global team, Coda is the place for you.
The Opportunity
We are looking for an independent, passionate, and persuasive Senior Security Engineer to join our Security Engineering team. You will play a crucial role in driving vulnerability remediation and securing applications from the outset, utilizing cutting-edge solutions to effectively prevent attacks and safeguard the business.
What you'll do
Work closely with the engineering team on all security initiatives, ensuring products are built securely by default and that audits and remediation efforts are managed to achieve smooth, timely resolution.
Conduct risk assessments and vulnerability analyses to identify threats and security gaps in existing and new systems and architectures.
Perform vulnerability scanning across networks, systems, middleware, and databases, then assess each finding by likelihood and potential impact to prioritize what matters.
Manage the remediation lifecycle with a risk-based approach, ensuring vulnerabilities are resolved in line with accepted industry standards.
Implement and manage static and dynamic code analysis (SAST/DAST) in CI/CD pipelines; perform source code security reviews and advise developers on remediation.
Manage the end-to-end process for externally reported vulnerabilities and bug bounty submissions.
Lead initiatives that measurably reduce risk across our application and infrastructure stack, including applying AI/ML tooling where it delivers real leverage.
Use scripting and automation to remove manual toil and improve team workflows, rather than defaulting to manual processes out of habit
What we expect
Take strong ownership of outcomes beyond assigned tasks: proactively identify risks, surface them early to the right stakeholders, and drive resolution without waiting to be asked.
Clarify vulnerabilities and risks directly with product and engineering stakeholders rather than assuming; communicate bad news, delays, scope changes, and newly discovered risks early, and always pair them with options, not just problems.
Stay flexible and resourceful, taking on new challenges as the business evolves
What you'll bring
At least 5+ years in cybersecurity, of which 3+ years is focused on vulnerability management
At least 3+ years in software development and scripting (Java, Node.js, Python) with continued hands-on use. Able to independently write scripts and simple web apps to solve day-to-day security needs
Solid foundations in networking, operating systems, and applications
Demonstrated track record of self-directed work rather than just completed assignments, with concrete examples of risks you identified, owned, and drove to resolution independently, including picking up new skills as needed
Strong stakeholder management: able to clarify vulnerabilities and risks directly with product and engineering, and communicate effectively with both technical and non-technical audiences
Bonus if you have
Experience building dedicated internal tools, dashboards, or CI/CD integrations beyond ad hoc scripting
Experience in bug bounty, penetration testing, and vulnerability assessment
Knowledge of cloud security
Knowledge of container security
Knowledge of AI security
Knowledge of DevSecOps and security tools in CI/CD
Hold OSCP, OSWE, AWS Certified Security - Specialty, Google Professional Cloud Security Engineer, Microsoft Certified: Azure Security Engineer Associate, GPEN, and/or CREST certification
Experience with a tech or financial services company
We are proud to be an equal opportunity employer, embracing the unique qualities of every individual, regardless of gender, race, age, religion, disability, or other local protected classes. Our goal is to foster an inclusive environment where everyone feels welcome and valued.
Due to the large number of exceptional applications we receive, we can only reach out to shortlisted candidates. If you don't hear from us, rest assured there may be another opportunity at Coda that aligns better with your unique abilities. Remember to check our Careers Page for more exciting job openings!
