Cybersecurity Engineer Intern (Web Security) - Information Security (Spring 2027) 工作, Shopee 公司招聘中 - Ricebowl

About The Team

The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.

Job Description

• Perform security assessments and penetration testing on Shopee's web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams.
• Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.
• Build and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline.
• Assess the security of AI-powered features and internal AI tooling — prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.
• Support vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences.
  
  

Requirements

• Currently pursuing Bachelor's degree or above in Computer Science, Information Security, Cyberspace Security or a related field preferred.
• Solid networking and web fundamentals: a working understanding of L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and the risks introduced by common cryptographic misuse.
• Familiar with the OWASP Top 10 — able to explain the root cause, exploitation path and correct remediation of each class; understands the mechanics and exploit chains of landmark vulnerabilities such as fastjson and log4j.
• Proficient in at least one of Go, Java, Python, PHP, C or JavaScript; able to read design documents and business code, and to script your way out of repetitive work.
• Basic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows.
• Aware of the security risks in AI / LLM applications (e.g. the OWASP Top 10 for LLM Applications), with genuine curiosity about how AI is reshaping both the attack surface and the defender's toolkit.
• A fast learner who communicates clearly — able to explain a vulnerability to engineers without a security background.
• Full-time interns preferred (3-6 months).
• Part-time interns who can commit at least 3 working days a week are also welcome to apply.
  
  

Preferred Qualifications

• Interested in security engineering: understands the basic principles and limitations of SAST / DAST / SCA, and prefers building tools over repeating manual work.
• CVEs credited in well-known open-source projects or general-purpose software, especially framework-level findings.
• Placements in CTF competitions, or a consistent track record on SRC / bug bounty platforms.
• Has built security tooling: scanners, fuzzers, SAST rules (Semgrep / CodeQL), Burp extensions, or LLM-based security automation and agents.
• A security blog, GitHub projects, conference talks or published research.