Encora

Principal Digital Security Architect

Kuala Lumpur · Work style not stated

Apply on the employer’s site ↗See how well you match this job

You apply directly with the employer. ROLIVA does not submit applications from this page and is not the employer.

About the role

Description from the employer’s posting. Check the employer’s page for the current version.

EmployerEncora
LocationKuala Lumpur
Work styleWork style not stated
Employer posted3 months ago

Key Responsibilities
1. API & Ecosystem Architecture
● The API Fortress: Architect the security layer for our API Gateway (e.g., Kong,
Apigee, AWS Gateway). Define global policies for Rate Limiting, Throttling, and
Authorization (preventing BOLA/IDOR attacks).
● Supply Chain Security: Design secure integration patterns for our 3rd party partners
(Fintechs, Credit Bureaus, Payment Processors). Ensure their insecurities do not
become our breaches.
● Microservices Mesh: Define how our internal services trust each other. Move from
"Network Trust" to "Cryptographic Trust" using mTLS and Service-to-Service
authentication.

2. Identity & Access Management (CIAM)
● Identity Strategy: Own the architecture for Customer Identity (CIAM). Design flows for
Biometric Binding, Adaptive MFA, and Step-Up Authentication for high-value
transactions.
● Token Lifecycle: Define the standards for OAuth 2.0 and OpenID Connect (OIDC).
Ensure we are using Financial-grade API (FAPI) standards for token issuance,
revocation, and storage.

Show full description

3. Secure Development Lifecycle (SDLC)
● Threat Modeling: Lead "Whiteboard Hacking" sessions with product owners. Identify
business logic flaws (e.g., race conditions in ledgers, bypassable KYC steps) before a
single line of code is written.
● Paved Roads: Work with DevOps to architect secure-by-default libraries. (Example:
Create a standard "Encryption Wrapper" library that all developers must use, so they
don't invent their own crypto).

4. Data Privacy & Cryptography
● Data Defense: Define the architecture for Field-Level Encryption (FLE) in the
database for PII and Banking Secrets.
● Privacy Engineering: Architect systems that support "Right to be Forgotten"
(GDPR/CCPA) without breaking the immutability of the financial ledger.
Strategic Deliverables
● Identity Patterns: Deliver new security design patterns and components for
authentication, authorization, SSO, MFA, and Partner security to ensure seamless and
secure user access.
● Mobile & Edge: Deliver new security design patterns and components for Mobile
security, ensuring consistency between iOS, Android, and the backend.
● Modern Tech Stack: Deliver API, container, cloud, and AI security design patterns to
support the bank's move toward intelligent, cloud-native infrastructure.

What We Are Looking For

1. The Background
● 8+ Years Experience: A mix of Software Engineering and Security Architecture.
● Ex-Developer: You must be able to read code (Java, Kotlin, React or Node.js, ).
● Banking/Fintech Experience: Strong preference for candidates who have secured
payment gateways, ledgers, or wallets.

2. The Technical Skills
● API Security: Deep mastery of REST and GraphQL security.
● Auth Protocols: You can draw the OAuth 2.0 Authorization Code Flow with PKCE
from memory. You understand JWT signing and JWKS key rotation.
● Mobile Security: Understanding of how mobile apps store secrets
(KeyStore/Keychain) and how to prevent API abuse from emulators/bots.

3. The Mindset
● Business Aligned: You understand that a bank exists to process transactions. You
design security that reduces risk without destroying the User Experience (UX).
● Pragmatic: You know when to demand a "Blocker" fix and when to accept a "Risk
Acceptance" waiver.

See how well you match this job Apply on the employer’s site ↗

Check your resume against this job Free, no sign-up. Nothing you paste is stored.

Staying safe while you apply

Never pay to apply, interview or accept an offer. ROLIVA never asks you for payment to apply to a job.
Apply only through the official “Apply on the employer’s site” button, on the employer’s own site, and check that a recruiter’s email uses that employer’s own domain rather than a free email address.
Be cautious of an offer made with no real interview, or pressure to decide quickly or share financial details early.

Does something look wrong with this listing? Use “Report broken link” in the role details, or read ROLIVA’s full job-safety guidance ↗.

Preparing for this role with ROLIVA

Check the fit.
Compare the requirements with the experience you have confirmed, including gaps.
Prepare honestly.
Build interview stories and application drafts from your own evidence.
Keep track.
Save the role and record your own application status and follow-ups.

Create a free workspace or log in.