Senior/Staff Engineer, Security Platform Development

United States Digital Space LLC; Hong Kong; On-site; HKD 1,090,909 - 1,575,758; Full time

Job summary

United States Digital Space LLC is seeking a Technical Expert to lead the development of its security engineering and DevSecOps capabilities, focusing on security product development, platform engineering, and SDK/Agent development.

The role demands deep security expertise, hands-on engineering, and the ability to drive security governance across business teams, with strong emphasis on RASP, runtime protection, and integration of code security tools.

Qualifications

• Strong foundation in operating systems, networking, and software security fundamentals.
• Experience building security products, platform engineering, and SDK/Agent development.
• Expert‑level Java proficiency with deep JVM knowledge.

Responsibilities

• Lead architecture and core development of end-to-end DevSecOps platform and security products.
• Own design and development of RASP/Java Agent runtime protection using bytecode tooling.
• Integrate SAST/DAST/IAST/ SCA and align with SonarQube and Coverity CI/CD gates.

Skills

Security engineering

DevSecOps

Java proficiency

JVM internals

Cloud security

Security governance

Education

Computer science degree

Tools

SonarQube

Coverity

ASM

ByteBuddy

Java Instrumentation

Job description

the company will be prioritising applicants who have a current right to work in Singapore, and do not require the company's sponsorship of a visa.

About The Opportunity

As a Technical Expert, you will lead the development of the company’s core security engineering and DevSecOps capabilities, with a strong focus on security product development, platform engineering, and SDK /Agent development. The ideal candidate should demonstrate deep security expertise, broad technical coverage, strong hands‑on engineering capability, and exceptional influence in driving security governance across business teams.

What You’ll Be Doing

1. Lead the architecture and core development of the company’s end-to-end DevSecOps platform, security products, and SDKs/Agents, covering code, build, artifacts, images, deployment, and runtime security.
2. Own the design and development of RASP / Java Agent runtime protection, leveraging ASM, ByteBuddy, and Java Instrumentation for bytecode enhancement, runtime hooks, detection and blocking engines, while continuously improving performance, stability, and compatibility.
3. Build and integrate SAST, DAST, IAST, SCA, code security scanning, and image security scanning into CI/CD workflows, and drive deep integration of tools such as SonarQube and Coverity to form a closed loop of scanning, gating, remediation and re-validation.
4. Drive core application security protection and offensive/defensive capabilities across scenarios such as XSS, SQL injection, SSRF, deserialization, command execution, authentication/authorization flaws, privilege escalation, and API security.
5. Advance AI-Native Security Engineering by applying LLMs and AI Agents to vulnerability analysis, rule generation, false‑positive reduction, remediation suggestions, security knowledge management, and workflow automation, while building deep understanding of their architecture, principles, and security implications.
6. Partner closely with business engineering teams to drive security standards, integration rules, quality gates, risk classification, remediation workflows, and overall security governance adoption.
7. Collaborate with engineering, architecture, operations, QA, and business stakeholders to solve complex security problems and turn them into scalable product capabilities, engineering solutions, and governance mechanisms.

What We Look For In You

1. Strong fundamentals in computer science and security, with deep understanding of operating systems, networking, compilers/JVM internals, distributed systems, application security, cloud‑native security, and software supply chain security, with both breadth and depth in security technologies.
2. Expert‑level Java proficiency, especially in JVM.