Senior Security Engineer (SDLC) - Information Security Team

2-4 Years

Job Description

Participate in the design, development, and continuous improvement of internal security tools and platforms, including but not limited to:
- AI-assisted code review and vulnerability analysis
- Static Application Security Testing (SAST)
- Software Composition Analysis (SCA) and software supply-chain security
- Security automation and other Secure SDLC tools.
Develop and improve security detection rules, analysis logic, and automated workflows based on security requirements.
Participate in secure code review, vulnerability analysis, and false-positive investigation to improve detection accuracy and vulnerability coverage.
Use AI-assisted development, code-analysis, and security-research tools to improve engineering and security-analysis efficiency.
Contribute to LLM- or Agent-based security tools involving repository search, tool use, task orchestration, and result validation.
Integrate security tools with Git, source-code management platforms, CI/CD pipelines, and other developer workflows.
Participate in feature development, testing, troubleshooting, performance improvement, and ongoing system maintenance.
Collaborate with security and engineering teams to support the analysis, remediation, and continuous improvement of security issues.
Keep up with developments in application security, DevSecOps, software supply-chain security, and AI-assisted security engineering.
Mentoring Junior Security Engineers and Intern.

Bachelor's degree in Computer Science, Information System, Software Engineering, Automation Engineering, or related field in Engineering.
At least 2 years of full time experience in security engineering or application security.
Practical experience using AI-assisted development, code-analysis, or security tools, with the ability to perform basic validation of AI-generated code and analysis results is preferred.
Good application security fundamentals and an understanding of common Web, API, and code-security risks, such as injection, access-control vulnerabilities, authentication and authorization weaknesses, SSRF, unsafe file handling, and sensitive-data exposure.
Basic code-reading and analysis skills, with the ability to understand the root causes and remediation approaches of common vulnerabilities.
Familiarity with at least one programming language, such as Go, Python, Java, or JavaScript, and the ability to implement common features, modify existing code, debug issues, and troubleshoot problems.
Good computer science fundamentals, including networking, operating systems, databases, processes, threads, and common software runtime mechanisms.