全职 Information Security - Client Security Engineer 工作, 薪水, Shopee 公司招聘中 - Ricebowl

Security assessment and vulnerability closure: Conduct security assessments and vulnerability research on the company's client-side products (Android / iOS / Electron), validate vulnerabilities discovered by AI and automated tools, drive engineering teams to remediate them, and complete retesting to close the loop.

• Secure SDLC implementation: Build and operate the client-side secure SDLC by establishing security checkpoints at requirements review, design review, code audit, and pre-release testing, integrating detection capabilities into CI/CD pipelines, and managing security assessment and onboarding approval for third-party SDKs and open-source components.
• Foundational protection capabilities: Build and maintain core client-side security capabilities, including app hardening, anti-debugging, anti-tampering, anti-hooking, runtime environment detection, communication security (e.g., certificate pinning), and secure local data storage.
• Business security solutions: Design security solutions at the architecture and system level for the specific scenarios of each business line, provide security support to the business, and follow through on implementation.
• Keep up with offensive and defensive techniques and industry developments in client-side security, and continuously raise the security posture of the company's client products.

• Bachelor's degree or above in information security, computer science, or a related field, with at least 3 years of mobile security experience at an internet company.
• Familiarity with Android and/or iOS system architecture and security mechanisms (sandboxing, permission models, code signing, Keychain, ATS, etc.).
• Familiarity with common mobile vulnerability types (exposed components, WebView vulnerabilities, Intent / Deeplink hijacking, insecure storage, cleartext transmission, etc.) and with standards such as OWASP MASVS / MASTG, plus a deep understanding of vulnerability root causes, exploitation, and remediation.
• Strong reverse engineering skills, proficiency with tools such as Jadx, IDA, Ghidra, Frida, and Objection, and familiarity with ARM assembly.
• Proficiency in at least one of Java / Kotlin / Swift / Objective-C / C/C++, and the ability to write automation tools in Python or similar languages.
• Experience with app hardening, code obfuscation, security SDK development, or mobile SDLC implementation is a plus.
• Some understanding of core LLM and AI Agent concepts, such as context, prompts, tool calling, and task decomposition. Hands-on AI for Security experience (e.g., using AI to assist with reverse engineering, code auditing, or vulnerability discovery) is a plus.
• Strong communication skills, cross-team collaboration skills, and the ability to drive projects forward.