Senior/Staff Engineer, Security Platform Development

OKX; Hong Kong; On-site; HKD 700,000 - 900,000; Full time

Benefits offered by this job

Competitive total compensation package

L&D programs and education subsidy

Various team building programs

Wellness and meal allowances

Comprehensive healthcare schemes

Job summary

OKX is seeking a Technical Expert to lead the development of its core security engineering and DevSecOps solutions in Hong Kong. The ideal candidate will have robust security product development skills and a strong understanding of various security vulnerabilities.

Key responsibilities include leading the architecture of a comprehensive DevSecOps platform, integrating security scanning tools, and collaborating with engineering teams to enhance overall security standards. This role requires proficiency in Java and experience with advanced security technologies.

Qualifications

• Strong fundamentals in computer science with a deep understanding of operating systems and security.
• Expert-level Java proficiency; also proficient in Python or Golang.
• Proven experience with RASP, SAST, DAST, IAST, SCA security capabilities.

Responsibilities

• Lead development of DevSecOps platform and security products.
• Build and integrate security scanning tools into CI/CD workflows.
• Drive application security across various threat scenarios.

Skills

Java proficiency

Python

Golang

Operating systems knowledge

Network security

Application security

RASP expertise

DevSecOps knowledge

AI in security

Tools

SonarQube

Coverity

ASM

ByteBuddy

Job description

OKX will be prioritising applicants who have a current right to work in Singapore, and do not require OKX's sponsorship of a visa.

About The Opportunity

As a Technical Expert, you will lead the development of the company’s core security engineering and DevSecOps capabilities, with a strong focus on security product development, platform engineering, and SDK/Agent development. The ideal candidate should demonstrate deep security expertise, broad technical coverage, strong hands‑on engineering capability, and exceptional influence in driving security governance across business teams.

What You’ll Be Doing

1. Lead the architecture and core development of the company’s end‑to‑end DevSecOps platform, security products, and SDKs/Agents, covering code, build, artifacts, images, deployment, and runtime security.
2. Own the design and development of RASP / Java Agent runtime protection, leveraging ASM, ByteBuddy, and Java Instrumentation for bytecode enhancement, runtime hooks, detection and blocking engines, while continuously improving performance, stability, and compatibility.
3. Build and integrate SAST, DAST, IAST, SCA, code security scanning, and image security scanning into CI/CD workflows, and drive deep integration of tools such as SonarQube and Coverity to form a closed loop of scanning, gating, remediation, and re‑validation.
4. Drive core application security protection and offensive/defensive capabilities across scenarios such as XSS, SQL injection, SSRF, deserialization, command execution, authentication/authorization flaws, privilege escalation, and API security.
5. Advance AI‑Native Security Engineering by applying LLMs and AI Agents to vulnerability analysis, rule generation, false‑positive reduction, remediation suggestions, security knowledge management, and workflow automation, while building deep understanding of their architecture, principles, and security implications.
6. Partner closely with business engineering teams to drive security standards, integration rules, quality gates, risk classification, remediation workflows, and overall security governance adoption.
7. Collaborate with engineering, architecture, operations, QA, and business stakeholders to solve complex security problems and transform them into scalable product capabilities, engineering solutions, and governance mechanisms.

What We Look For In You

1. Strong fundamentals in computer science and security, with deep understanding of operating systems, networking, compilers/JVM internals, distributed systems, application security, cloud‑native security, and software supply chain security, with both breadth and depth in security technologies.
2. Expert‑level Java proficiency, especially in JVM internals, ClassLoader, Java Agent, ASM, ByteBuddy, bytecode instrumentation, profiling, and performance tuning; proficient in Python or Golang as well.
3. Proven hands‑on experience with RASP, SAST, DAST, IAST, SCA, image security, and code security scanning, with the ability to independently design, integrate, and productionize security capabilities.
4. Strong offensive and defensive security experience, with deep understanding of vulnerability root causes, exploitation techniques, detection logic, bypass methods, and remediation strategies in web, API, and microservice environments.
5. Strong practical experience with LLMs and AI Agents, plus deep understanding of model architecture, agent design, tool invocation, context engineering, evaluation methods, and the impact of AI on both security engineering and attacker capabilities.
6. Strong engineering and product mindset, capable of leading the design and implementation of security products, platform modules, and SDKs/Agents while balancing security effectiveness, performance overhead, integration cost, and operability.
7. Strong ownership, communication skills, and cross‑functional influence, with a proven ability to drive business teams on security governance, policy adoption, and remediation outcomes.

Preferred Qualifications

• Background from top‑tier Internet companies, cloud providers, or leading cybersecurity vendors.
• Experience leading DevSecOps platforms, application security platforms, RASP systems, code scanning platforms, or cloud‑native security platforms.
• Strong experience in security product development, SDK/Agent development, vulnerability research, penetration testing, red/blue team exercises, or incident response.
• Hands‑on experience in AI + Security initiatives such as security copilots, intelligent rule generation, automated vulnerability analysis, or remediation recommendation systems.

Perks & Benefits

• Competitive total compensation package
• L&D programs and education subsidy for employees' growth and development
• Various team building programs and company events
• Wellness and meal allowances
• Comprehensive healthcare schemes for employees and dependants
• More that we love to tell you along the process!