Cybersecurity Engineer (Web Security) - Information Security (2027 Graduate)

United States Digital Space LLC; Singapore; On-site; SGD 40,000 - 70,000; Full time

Job summary

United States Digital Space LLC in Singapore seeks an entry-level security engineer to safeguard web apps, APIs and internal systems. You will perform security assessments, review code for flaws, and help embed secure practices into the development pipeline.

The role emphasizes hands-on learning, building security tooling, and collaborating with engineers to address AI/LLM security risks, vulnerability response, and incident investigation.

Qualifications

• Solid networking and web fundamentals.
• Familiar with OWASP Top 10 and remediation strategies.
• Proficient in at least one programming language (Go/Java/Python/ PHP/C/JavaScript).
• Knowledge of business-logic vulnerabilities.
• Awareness of AI/LLM security risks.
• Strong communication and rapid learning abilities.

Responsibilities

• Perform security assessments and penetration testing on the company’s web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams.
• Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.
• Build and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline.
• Assess the security of AI-powered features and internal AI tooling — prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.
• Support vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences.

Skills

Networking basics

OWASP Top 10

Programming languages

Business-logic vulnerabilities

AI/LLM security

Effective communication

Tools

SAST/DAST/SCA

Burp Suite

Semgrep

CodeQL

LLM-based security tools

Job description

Department Engineering and TechnologyLevelEntry LevelLocationSingaporeThe Engineering and Technology team is at the core of the the company platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. the company's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.

About the Team:the company will be prioritizing applicants who have a current right to work in Singapore, and do not require the company sponsorship of a visa.

K indly note that you can only be considered in one recruitment process at a time within Sea Group and will be considered for jobs in the order that you have applied.

The Engineering and Technology team is at the core of the the company platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. the company's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.Job Description:

• Perform security assessments and penetration testing on the company's web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams.

• Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.
• Build and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline.
• Assess the security of AI-powered features and internal AI tooling — prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.
• Support vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences.

Requirements:

• Solid networking and web fundamentals: a working understanding of L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and the risks introduced by common cryptographic misuse.
• Familiar with the OWASP Top 10 — able to explain the root cause, exploitation path and correct remediation of each class; understands the mechanics and exploit chains of landmark vulnerabilities such as fastjson and log4j.
• Proficient in at least one of Go, Java, Python, PHP, C or JavaScript; able to read design documents and business code, and to script your way out of repetitive work.
• Basic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows.
• Aware of the security risks in AI / LLM applications (e.g. the OWASP Top 10 for LLM Applications), with genuine curiosity about how AI is reshaping both the attack surface and the defender's toolkit.
• A fast learner who communicates clearly — able to explain a vulnerability to engineers without a security background.

Preferred Qualifications:

• Interested in security engineering: understands the basic principles and limitations of SAST / DAST / SCA, and prefers building tools over repeating manual work.
• CVEs credited in well-known open-source projects or general-purpose software, especially framework-level findings.
• Placements in CTF competitions, or a consistent track record on SRC / bug bounty platforms.
• Has built security tooling: scanners, fuzzers, SAST rules (Semgrep / CodeQL), Burp extensions, or LLM-based security automation and agents.
• A security blog, GitHub projects, conference talks or published research.