全职 Senior Security Engineer (SDLC) - Information Security Team 工作, 薪水, Shopee 公司招聘中 - Ricebowl

Our security engineering team builds internal platforms that help developers deliver secure software efficiently. We develop Secure SDLC capabilities including SAST, SCA, software supply-chain security, and DevSecOps automation. We also apply AI and Agent technologies to code review, vulnerability analysis, false-positive reduction, and security automation, embedding security directly into CI/CD pipelines and developer workflows.

• Participate in the design, development, and continuous improvement of internal security tools and platforms, including but not limited to:
  • AI-assisted code review and vulnerability analysis;
  • Static Application Security Testing (SAST);
  • Software Composition Analysis (SCA) and software supply-chain security;
  • Security automation and other Secure SDLC tools.
• Develop and improve security detection rules, analysis logic, and automated workflows based on security requirements.
• Participate in secure code review, vulnerability analysis, and false-positive investigation to improve detection accuracy and vulnerability coverage.
• Use AI-assisted development, code-analysis, and security-research tools to improve engineering and security-analysis efficiency.
• Contribute to LLM- or Agent-based security tools involving repository search, tool use, task orchestration, and result validation.
• Integrate security tools with Git, source-code management platforms, CI/CD pipelines, and other developer workflows.
• Participate in feature development, testing, troubleshooting, performance improvement, and ongoing system maintenance.
• Collaborate with security and engineering teams to support the analysis, remediation, and continuous improvement of security issues.
• Keep up with developments in application security, DevSecOps, software supply-chain security, and AI-assisted security engineering.
• Mentoring Junior Security Engineers and Intern.

• Bachelor’s degree in Computer Science, Information System, Software Engineering, Automation Engineering, or related field in Engineering.
• At least 2 years of full time experience in security engineering or application security.
• Practical experience using AI-assisted development, code-analysis, or security tools, with the ability to perform basic validation of AI-generated code and analysis results is preferred.
• Good application security fundamentals and an understanding of common Web, API, and code-security risks, such as injection, access-control vulnerabilities, authentication and authorization weaknesses, SSRF, unsafe file handling, and sensitive-data exposure.
• Basic code-reading and analysis skills, with the ability to understand the root causes and remediation approaches of common vulnerabilities.
• Familiarity with at least one programming language, such as Go, Python, Java, or JavaScript, and the ability to implement common features, modify existing code, debug issues, and troubleshoot problems.
• Good computer science fundamentals, including networking, operating systems, databases, processes, threads, and common software runtime mechanisms.