jobs in Shopee

Kerja Sepenuh Masa, Information Security - Secure SDLC Engineer di Shopee - Maukerja

Information Security - Secure SDLC Engineer

Shopee

Sepenuh Masa

Singapore

Kongsi
Simpan

Lokasi Kerja

  • Singapore

Penerangan Kerja

Tanggungjawab

Department Engineering and Technology
LevelExperienced (Individual Contributor)
LocationSingapore

The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.

Job Description:
  • Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes;
  • Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline, to improve SDLC quality and efficiency;
  • Participate in security reviews of business requirements and architecture designs, and perform security assessments, testing and penetration testing of web applications, APIs and internal systems;
  • Design security solutions at the architecture and system level, and provide security support to business lines and drive their implementation;
  • Build and improve security automation and tooling, including in-house AI agents for security workflows, to scale coverage beyond manual review;
  • Assess the security of AI-powered features and internal AI tooling, such as prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations;
  • Support vulnerability response and incident investigation, and keep up with industry trends to continuously strengthen the company’s security posture.
Requirements:
  • Bachelor’s degree or above in Information Security, Computer Science or a related field, with at least 3 years of security-related experience at an internet company;
  • Solid web and networking fundamentals: familiar with common web vulnerabilities and the OWASP Top 10, able to explain the root cause, exploitation path and correct remediation of each class, and understand L4/L7 protocols, HTTP, TLS, and session and authentication mechanisms;
  • Hands-on experience in rolling out SDLC processes and building security programs on the in-house (enterprise) side, with SDLC experience at an internet company; experience independently leading SDLC adoption for a large business line is a plus;
  • Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript, with development or security architecture experience and an understanding of common internet technology architectures and practices;
  • Extensive experience in vulnerability research, code auditing and security solution design, with knowledge of industry standards and security frameworks;
  • Solid understanding of core LLM and AI Agent concepts (context, prompts, tool calling and task decomposition) and hands-on AI for Security experience; aware of the security risks in AI/LLM applications (e.g. OWASP Top 10 for LLM Applications);
  • Strong communication skills, cross-team collaboration and project-driving ability, able to explain vulnerabilities clearly to engineers without a security background.

Peringatan Penting

Jangan pernah kongsikan maklumat bank atau kad kredit anda semasa memohon pekerjaan. Elakkan membuat sebarang pembayaran atau mengisi survey yang tidak berkaitan. Jika ada yang mencurigakan, sila laporkan iklan pekerjaan ini segera.

Lebih Lanjut