Senior Security Engineer

Humanity; Hong Kong; On-site; HKD 900,000 - 1,400,000; Full time

Job summary

Humanity in Hong Kong seeks a hands-on Security Engineer to own cloud security for our exchange and business units. You will harden AWS Baseline, build detection pipelines, run incident response during Hong Kong hours, and lead AI-driven security testing and triage.

You will also review on-chain and code integrations for secure data handling and robust defenses. The role requires 5+ years in security engineering, 3+ in cloud security on AWS, plus experience with EDR/XDR, CSPM tools, and crypto

Qualifications

• 5+ years in security engineering, with at least 3 years hands-on in cloud security on AWS
• At least 1 year experience at a crypto exchange, custodian or high-value fintech
• Experience with IAM, MFA, and least-privilege controls
• Experience building/tuning SIEM detections as code and measuring false positives
• Hands-on with autonomous or LLM-driven security tooling
• Fluent Cantonese is strong for local teams

Responsibilities

• Own the security posture of AWS: IAM least privilege, SCPs, VPC segmentation, KMS and secrets management
• Harden Kubernetes and container workloads: admission control, image signing, runtime policy
• Operate CSPM/CNAPP platforms and drive misconfigurations to closure
• Own incident response end-to-end during Hong Kong hours
• Lead AI pentest agents and purple-team exercises
• Review exchange and on-chain integration for secure data handling

Skills

AWS security

Incident response

Detection engineering

LLM tooling

Kubernetes security

IAM least privilege

OSCP or certs

Cantonese

Tools

Wiz

Prisma Cloud

AWS Security Hub

CrowdStrike

SentinelOne

Microsoft Defender

OWASP ZAP

Job description

You will be the hands-on security engineer working directly under our Head of Security, owning the security of our cloud infrastructure and the detection and response capability that protects the exchange and its business units.

You will harden AWS to a defensible baseline, build the detection pipeline that catches attackers, stop initial access, lead incident response during Hong Kong hours, and use LLM-driven agents (Strix, Cairn-style harnesses, Claude / GPT-based tooling) to automate the offensive testing and triage.

What You will Do

1. Cloud and Infrastructure Hardening

• Own the security posture of AWS: IAM least privilege, SCPs and Organizations guardrails, VPC segmentation, KMS and secrets management, CIS benchmarks, and infrastructure-as-code review.
• Harden Kubernetes and containerised workloads: admission control, image signing, runtime policy, network policy, and workload identity.
• Operate a CSPM / CNAPP platform (Wiz, Prisma Cloud, AWS Security Hub or similar) and drive misconfiguration findings to closure with engineering.
• Own identity and access as the first line of defence: phishing-resistant MFA, conditional access, just-in-time privileged access, service-account and API-key lifecycle, and ongoing access reviews
• Define and enforce the change-management and deployment controls that prevent process failures from becoming incidents: break the glass procedures, production changes.

2. Detection and Response

• Build and tune detection in the log system: log coverage across CloudTrail, GuardDuty, Kubernetes audit, EDR, identity provider, VPN and SaaS.
• Build exchange-specific detections: withdrawal-flow anomalies, API-key abuse, admin-panel misuse, hot and cold wallet movements on-chain, and insider-threat signals
• Operate EDR / XDR (CrowdStrike, SentinelOne or Microsoft Defender) across endpoints, servers and cloud workloads, including the response playbooks
• Own incident response end-to-end during Hong Kong hours and non-office hour: From triage, containment, cloud and host forensics, communication, post-mortems, lesson learn and coordination with our managed detection provider

3. AI Offensive Security

• Run autonomous AI pentest agents (Strix, Cairn-style harnesses, or equivalent) against exchange APIs, web and mobile frontends, admin panels and cloud infrastructure.
• Lead purple-team exercises that replay realistic attack paths: AI-agent-driven initial access, API-key theft, withdrawal-logic bypass, account takeover, and insider threat; close the gaps found and measure detection coverage before and after
• Use LLMs to scale security operations: alert summarisation, log query generation, detection-rule fine tuning.

4. Exchange and Security Code Review

• Conduct deep-dive source code reviews of exchange Infrastructure, prioritizing MPC/HSM integrations and withdrawal approval logic.
• Inspect the source code and on-chain monitoring tools to ensure secure data handling and robust integration with detection pipelines.
• Triage and manually validate findings from SCA & SAST & DAST, and secrets-scanning tools to recommend secure code remediations.

Requirements

• 5+ years in security engineering, with at least 3 years hands-on in cloud security on AWS, and at least 1 year at a crypto exchange, custodian or high-value fintech
• Detection engineering experience: you have written and tuned SIEM detections as code, measured false-positive rates, and can show detections in real world attack.
• Incident response experience in cloud environments: you have led at least one real incident through containment, forensics and post-mortem, and can walk through it
• Hands-on experience with autonomous or LLM-driven security tooling: you have run AI pentest agents (Strix, Cairn-style harnesses, XBOW or equivalent) or built LLM-assisted
• Experience deploying and operating an EDR / XDR platform and a CSPM
• Working knowledge of exchange attack paths: API-key abuse, withdrawal-flow bypass, account takeover, and the basics of wallet architecture (MPC / HSM, hot / cold flows)
• OSCP is highly preferable, also one the following: AWS Certified Security, Professional Cloud Security Engineer, CKS, GCIH, GCFA.
• Fluent in Cantonese is a strong advantage for working with local teams