Information Security - Client Security Engineer

Shopee; Singapore; In loco; SGD 120.000 - 180.000; Tempo pieno

Descrizione del lavoro

Shopee is seeking a security expert to perform mobile security assessments across Android, iOS, and Electron apps, validate AI-reported vulnerabilities, and push remediation through engineering teams. The role focuses on building a secure SDLC, implementing app hardening, anti-tampering, and secure data storage, while staying ahead of evolving security threats.

You will work with cross-disciplinary teams to design security solutions at architecture and system levels and maintain ongoing security

Competenze

• Bachelor's degree in information security, computer science, or related field; minimum 3 years mobile security experience
• Familiarity with Android/iOS system architecture, sandboxing, permissions, code signing, Keychain, ATS
• Knowledge of mobile vulnerability types (WebView, insecure storage, cleartext transmission) and OWASP MASVS/MASTG
• Strong reverse engineering skills; experience with Jadx, IDA, Ghidra, Frida, Objection; ARM assembly familiarity
• Proficient in Java/Kotlin/Swift/Obj-C/C/C++; able to write automation tools in Python
• Experience in app hardening, obfuscation, security SDK development, or mobile SDLC; AI for security is a plus
• Excellent communication and cross-team collaboration; able to drive projects forward
• Hands-on AI for Security experience is a plus

Mansioni

• Conduct security assessments and vulnerability research on client-side products (Android/iOS/Electron) and validate findings
• Build and operate secure SDLC for client-side apps, integrate security checks into CI/CD pipelines
• Develop core client-side protection capabilities: hardening, anti-tampering, anti-debugging, secure storage
• Design security solutions at platform and system level for different business lines and provide security support
• Keep up with offensive/defensive techniques and AI trends to continuously raise security posture

Conoscenze

Mobile security

Reverse engineering

Python automation

Software security

AI for security

Communication

Formazione

Bachelor's degree in information security / CS

Strumenti

Jadx

IDA

Ghidra

Frida

Objection

Descrizione del lavoro

Job Description

Security assessment and vulnerability closure: Conduct security assessments and vulnerability research on the company's client-side products (Android / iOS / Electron), validate vulnerabilities discovered by AI and automated tools, drive engineering teams to remediate them, and complete retesting to close the loop.

• Secure SDLC implementation: Build and operate the client-side secure SDLC by establishing security checkpoints at requirements review, design review, code audit, and pre-release testing, integrating detection capabilities into CI/CD pipelines, and managing security assessment and onboarding approval for third-party SDKs and open-source components.


• Foundational protection capabilities: Build and maintain core client-side security capabilities, including app hardening, anti-debugging, anti-tampering, anti-hooking, runtime environment detection, communication security (e.g., certificate pinning), and secure local data storage.


• Business security solutions: Design security solutions at the architecture and system level for the specific scenarios of each business line, provide security support to the business, and follow through on implementation.


• Keep up with offensive and defensive techniques and industry developments in client-side security, and continuously raise the security posture of the company's client products.

Requirements

• Bachelor's degree or above in information security, computer science, or a related field, with at least 3 years of mobile security experience at an internet company.


• Familiarity with Android and/or iOS system architecture and security mechanisms (sandboxing, permission models, code signing, Keychain, ATS, etc.).


• Familiarity with common mobile vulnerability types (exposed components, WebView vulnerabilities, Intent / Deeplink hijacking, insecure storage, cleartext transmission, etc.) and with standards such as OWASP MASVS / MASTG, plus a deep understanding of vulnerability root causes, exploitation, and remediation.


• Strong reverse engineering skills, proficiency with tools such as Jadx, IDA, Ghidra, Frida, and Objection, and familiarity with ARM assembly.


• Proficiency in at least one of Java / Kotlin / Swift / Objective-C / C/C++, and the ability to write automation tools in Python or similar languages.


• Experience with app hardening, code obfuscation, security SDK development, or mobile SDLC implementation is a plus.


• Some understanding of core LLM and AI Agent concepts, such as context, prompts, tool calling, and task decomposition. Hands-on AI for Security experience (e.g., using AI to assist with reverse engineering, code auditing, or vulnerability discovery) is a plus.


• Strong communication skills, cross-team collaboration skills, and the ability to drive projects forward.