Information Security Engineer (Security Operations)(A03596)

Xiaomi Technology; Singapore; On-site; SGD 90,000 - 130,000; Full time

Job summary

Xiaomi Technology seeks a security operations professional to manage end-to-end security solutions, monitor for threats, and drive API security across international operations. You will lead vulnerability management, collaborate with R&D for fixes, and ensure compliance with regional data protection standards.

The role requires experience with WAF/IDS, API security, and automation tooling, and emphasizes cross-regional collaboration and Mandarin/English proficiency. Singapore-based, on-site work.

Qualifications

• Bachelor's degree or higher in Computer Science, Information Security, or related field.
• Minimum 3 years of experience in information security operations; international business security experience is preferred.

Responsibilities

• Manage end-to-end lifecycle of core security solutions (WAF, MiShield, HIDS) for Xiaomi's international portfolio; configure policies, optimize rules, and expand coverage against threats.
• Develop real-time monitoring/alerting frameworks; analyze security logs to detect anomalies and produce root-cause analyses.
• Lead API security framework design for international operations; implement abnormal behavior detection and access control policies; integrate with gateways/microservices and enforce security guidelines.
• Oversee vulnerability processes (scanning, risk assessment, remediation) for international business; perform red/blue exercises and coordinate with R&D for fixes.
• Ensure security operations comply with GDPR and PDPA; collaborate with cross-regional teams and third-party vendors for security support and training.

Skills

WAF

IDS

API security design

Vulnerability management

Python/Shell scripting

Security automation tools

Education

Bachelor's degree in Computer Science / Information Security

Tools

Nessus

Burp Suite

API gateways

Job description

1. Security Protection System Operations

• - Manage the end-to-end lifecycle of core security solutions (including WAF, MiShield, HIDS) for Xiaomi's international business portfolio, including configuring policies, optimizing rules, and expanding coverage to protect web/mobile applications against common threats (e.g., OWASP Top 10).
• - Develop real-time monitoring/alerting frameworks, analyze security logs to detect anomalous traffic and attack activities, produce root-cause analysis reports, and enhance defense strategies.

2. API Security Capability Development

• - Lead the design of an API security framework for international operations, ensuring end-to-end interface protection. Create models for abnormal behavior detection and access control policies to mitigate risks like unauthorized data access and API abuse.
• - Integrate with API gateways/microservices, incorporate SAST/DAST tools to advance shift-left security practices, and establish developer security guidelines.

3. Vulnerability Management

• - Oversee end-to-end vulnerability processes (scanning, risk assessment, remediation) for international business. Implement high-risk vulnerability response mechanisms and collaborate with R&D teams on code-level fixes.
• - Monitor global threat intelligence and zero-day vulnerabilities, organize regular red/blue team exercises, and refine emergency response protocols.

4. Compliance and Collaboration Support

• - Ensure security operations adhere to regional regulatory standards, including GDPR and Singapore Personal Data Protection Act (PDPA), and prepare compliance audit reports.
• - Collaborate with international business units, local compliance teams, and third-party vendors to deliver security technical support and training.

1. Education and Experience

• - Bachelor's degree or higher in Computer Science, Information Security, or a related field.
• - Minimum 3 years of experience in information security operations; experience in international business security within the internet industry is highly preferred.

2. Technical Skills

• - Expertise in operating security products (e.g., WAF, IDS).
• - Proficiency in API security design/protection, including OWASP API Top 10 knowledge and gateway security policy deployment.
• - Familiarity with vulnerability management processes and tools (e.g., Nessus, Burp Suite), along with the ability to reproduce vulnerabilities and validate remediation efforts.
• - Proficiency in scripting languages like Python/Shell; experience in developing security automation tools is an advantage.

3. Core Competencies

• - Knowledge of international data security regulations and compliance requirements, with effective cross-regional team collaboration skills.
• - Fluency in English and Mandarin (spoken and written) for daily work; professional certifications such as CISSP or CSSLP are preferred.
• - Strong sense of responsibility and problem-solving abilities, with the capacity to respond to unexpected security incidents.