Information Security - Client Security Engineer

SHOPEE SINGAPORE PRIVATE LIMITED; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

Shopee Singapore Private Limited's Engineering and Technology team builds the core of the Shopee platform, pairing passionate engineers with the latest technologies to create secure, scalable systems.

The role focuses on security assessment of client-side products (Android/iOS/Electron), driving remediation with engineering teams, and integrating secure SDLC practices across CI/CD pipelines to raise the overall security posture.

Qualifications

• Bachelor's degree or above in information security, computer science, or related field.
• At least 3 years of mobile security experience at an internet company.

Responsibilities

• Security assessments and vulnerability research on client-side products (Android/iOS/Electron).
• Validate vulnerabilities discovered by AI and automated tools; drive remediation with engineering teams; retest to close the loop.
• Build and operate the client-side secure SDLC with checkpoints across requirements, design, code, and pre-release testing.

Skills

Mobile security

Reverse engineering

Security assessment

Secure SDLC

Communication

Education

Bachelor's degree

Tools

Jadx

IDA

Ghidra

Frida

Objection

Job description

The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.

Job Description:

Security assessment and vulnerability closure: Conduct security assessments and vulnerability research on the company's client-side products (Android / iOS / Electron), validate vulnerabilities discovered by AI and automated tools, drive engineering teams to remediate them, and complete retesting to close the loop.

• Secure SDLC implementation: Build and operate the client-side secure SDLC by establishing security checkpoints at requirements review, design review, code audit, and pre-release testing, integrating detection capabilities into CI/CD pipelines, and managing security assessment and onboarding approval for third-party SDKs and open-source components.
• Foundational protection capabilities: Build and maintain core client-side security capabilities, including app hardening, anti-debugging, anti-tampering, anti-hooking, runtime environment detection, communication security (e.g., certificate pinning), and secure local data storage.
• Business security solutions: Design security solutions at the architecture and system level for the specific scenarios of each business line, provide security support to the business, and follow through on implementation.
• Keep up with offensive and defensive techniques and industry developments in client-side security, and continuously raise the security posture of the company's client products.

Requirements:

• Bachelor's degree or above in information security, computer science, or a related field, with at least 3 years of mobile security experience at an internet company.
• Familiarity with Android and/or iOS system architecture and security mechanisms (sandboxing, permission models, code signing, Keychain, ATS, etc.).
• Familiarity with common mobile vulnerability types (exposed components, WebView vulnerabilities, Intent / Deeplink hijacking, insecure storage, cleartext transmission, etc.) and with standards such as OWASP MASVS / MASTG, plus a deep understanding of vulnerability root causes, exploitation, and remediation.
• Strong reverse engineering skills, proficiency with tools such as Jadx, IDA, Ghidra, Frida, and Objection, and familiarity with ARM assembly.
• Proficiency in at least one of Java / Kotlin / Swift / Objective-C / C/C++, and the ability to write automation tools in Python or similar languages.
• Experience with app hardening, code obfuscation, security SDK development, or mobile SDLC implementation is a plus.
• Some understanding of core LLM and AI Agent concepts, such as context, prompts, tool calling, and task decomposition. Hands-on AI for Security experience (e.g., using AI to assist with reverse engineering, code auditing, or vulnerability discovery) is a plus.
• Strong communication skills, cross-team collaboration skills, and the ability to drive projects forward.