Cybersecurity Engineer (Security Operations) - Junior

Xiaomi; Singapore; On-site; SGD 180,000 - 260,000; Full time

Job summary

Xiaomi, based in Singapore, seeks an experienced security leader to manage international security systems and drive API security framework development for global apps. You will oversee vulnerability management, threat monitoring, and compliance with GDPR and PDPA, coordinating with R&D and regional teams to strengthen defenses.

The role requires strong scripting skills, experience with WAF and IDS, and fluency in English and Mandarin to collaborate with stakeholders across China and other

Qualifications

• Bachelor’s degree or higher in Computer Science, Information Security, or related field.
• Expertise with WAF and IDS security products.
• Proficiency in API security design, OWASP API Top 10, and gateway policy deployment.
• Familiarity with vulnerability management tools (Nessus, Burp Suite) and remediation.
• Proficiency in Python and Shell scripting.
• Knowledge of international data security regulations and compliance.
• Ability to communicate in English and Mandarin with stakeholders and teams.

Responsibilities

• Oversee full lifecycle of core security solutions for Xiaomi's international operations.
• Develop real-time monitoring and alerting frameworks; analyze logs and detect attacks.
• Design and implement an API security framework for international operations.
• Integrate API security with gateways and microservices; promote shift-left security.
• Oversee vulnerability management, risk assessment, and remediation.
• Monitor global threat intelligence; organize red/blue team exercises.
• Ensure compliance with GDPR and Singapore PDPA; prepare audit reports.
• Collaborate with regional units and vendors to provide security support and training.

Skills

Security architecture

Threat monitoring

Vulnerability management

API security

Scripting

Communication

Education

Bachelor’s degree in CS/InfoSec

Tools

WAF

IDS

Nessus

Burp Suite

SAST/DAST

Job description

Job Summary

Manage and enhance Xiaomi’s international security systems, lead API security framework development, oversee vulnerability management, and ensure compliance with global data protection regulations to safeguard web and mobile applications.

Responsibilities

• Manage the full lifecycle of core security solutions (WAF, MiShield, HIDS) for Xiaomi’s international business, including configuring policies, optimizing rules, and expanding coverage to protect web and mobile applications against threats such as OWASP Top 10
• Develop real-time monitoring and alerting frameworks to analyze security logs, detect anomalous traffic and attacks, produce root-cause analysis reports, and improve defense strategies
• Contribute to the design and implementation of an API security framework for international operations, creating models for abnormal behavior detection and access control to prevent unauthorized data access and API abuse
• Integrate API security with gateways and microservices, incorporate SAST/DAST tools to promote shift-left security practices, and establish developer security guidelines
• Oversee vulnerability management processes including scanning, risk assessment, and remediation for international business, implementing high-risk vulnerability response mechanisms and collaborating with R&D teams on code-level fixes
• Monitor global threat intelligence and zero-day vulnerabilities, organize red/blue team exercises, and refine emergency response protocols
• Ensure security operations comply with regional regulations such as GDPR and Singapore PDPA, preparing compliance audit reports
• Collaborate with international business units, local compliance teams, and third‑party vendors to provide security technical support and training

Required competencies and certifications

• Bachelor’s degree or higher in Computer Science, Information Security, or related field
• Expertise in operating security products such as WAF and IDS
• Proficiency in API security design and protection, including knowledge of OWASP API Top 10 and gateway security policy deployment
• Familiarity with vulnerability management tools and processes (e.g., Nessus, Burp Suite), with ability to reproduce vulnerabilities and validate remediation
• Proficiency in scripting languages like Python and Shell
• Knowledge of international data security regulations and compliance requirements
• Ability to communicate effectively in English and Mandarin to support collaboration with Mandarin‑speaking stakeholders, regional customers, engineering teams, and colleagues based in China.

Preferred competencies and qualifications

• Experience in developing security automation tools
• Professional certifications such as CISSP or CSSLP