Information Security Engineer (Security Operations)(A03596)

Xiaomi Technology; Singapore; On-site; SGD 90,000 - 130,000; Full time

Benefits offered by this job

Restaurant d'entreprise

Indemnités de stage/alternance

Job summary

Xiaomi Technology 在新加坡等国际市场招募一名资深网络安全职位，负责统筹全球安全防护体系的运维与优化，覆盖WAF、MiShield、HIDS等核心产品，确保对Web与移动应用的威胁防护达到行业标准。

岗位将主导国际化的API安全能力开发，设计端到端接口保护框架，结合网关/微服务，落地SAST/DAST等左移安全实践，并制定开发者安全指南，降低潜在风险。

同时负责漏洞管理、合规与培训工作，开展全球威胁情报监控、红蓝演练、应急响应流程，确保符合GDPR与PDPA等法规要求，并与跨区域团队协作提供技术支持。

Qualifications

• 本科及以上学历，计算机科学、信息安全或相关领域。
• 具备对核心安全产品（WAF、IDS）的操作经验。
• 熟悉API安全设计、OWASP API Top 10知识与网关策略落地。
• 具备漏洞管理流程与工具经验（如 Nessus、Burp Suite）。
• 熟练Python/Shell脚本，具备开发安全自动化工具的能力者优先。
• 具备国际化安全合规经验，英语与汉语沟通能力强，持有 CISSP/CSSLP 优先。

Responsibilities

• 管理核心安全解决方案端到端生命周期（WAF、MiShield、HIDS），配置策略、优化规则、扩展覆盖以保护Web/移动应用。
• 开发实时监控/告警框架，分析日志检测异常流量与攻击活动，编写根因分析报告，提升防御能力。
• 主导国际化API安全能力建设，设计端到端接口保护框架，结合网关/微服务实现访问控制与监测。
• 与SAST/DAST工具深度集成，制定开发者安全指南，推动左移安全实践。
• 负责全球漏洞管理、情报监控、红蓝演练与应急响应流程，确保修复落地并提升响应速率。
• 确保合规运营，符合GDPR与PDPA等区域法规要求，推动跨区域培训与技术支持。

Skills

WAF

IDS

API security

OWASP Top10

网关安全

Nessus

Burp Suite

Python

Shell 脚本

安全自动化

跨区域协作

英语/汉语沟通

CISSP/CSSLP（偏好）

Education

计算机科学/信息安全本科及以上

Tools

Nessus

Burp Suite

SAST/DAST 工具

API 网关

Job description

职位描述：

1. Security Protection System Operations

• Manage the end-to-end lifecycle of core security solutions (including WAF, MiShield, HIDS) for Xiaomi’s international business portfolio, including configuring policies, optimizing rules, and expanding coverage to protect web/mobile applications against common threats (e.g., OWASP Top 10).
• Develop real-time monitoring/alerting frameworks, analyze security logs to detect anomalous traffic and attack activities, produce root-cause analysis reports, and enhance defense strategies.

2. API Security Capability Development

• Lead the design of an API security framework for international operations, ensuring end-to-end interface protection. Create models for abnormal behavior detection and access control policies to mitigate risks like unauthorized data access and API abuse.
• Integrate with API gateways/microservices, incorporate SAST/DAST tools to advance shift-left security practices, and establish developer security guidelines.

3. Vulnerability Management

• Oversee end-to-end vulnerability processes (scanning, risk assessment, remediation) for international business. Implement high-risk vulnerability response mechanisms and collaborate with R&D teams on code-level fixes.
• Monitor global threat intelligence and zero-day vulnerabilities, organize regular red/blue team exercises, and refine emergency response protocols.

4. Compliance and Collaboration Support

• Ensure security operations adhere to regional regulatory standards, including GDPR and Singapore Personal Data Protection Act (PDPA), and prepare compliance audit reports.
• Collaborate with international business units, local compliance teams, and third-party vendors to deliver security technical support and training.

职位要求：

1. Education and Experience

• Bachelor’s degree or higher in Computer Science, Information Security, or a related field.

2. Technical Skills

• Expertise in operating security products (e.g., WAF, IDS).
• Proficiency in API security design/protection, including OWASP API Top 10 knowledge and gateway security policy deployment.
• Familiarity with vulnerability management processes and tools (e.g., Nessus, Burp Suite), along with the ability to reproduce vulnerabilities and validate remediation efforts.
• Proficiency in scripting languages like Python/Shell; experience in developing security automation tools is an advantage.

3. Core Competencies

• Knowledge of international data security regulations and compliance requirements, with effective cross-regional team collaboration skills.
• Fluency in English and Mandarin (spoken and written) for daily work; professional certifications such as CISSP or CSSLP are preferred.
• Strong sense of responsibility and problem-solving abilities, with the capacity to respond to unexpected security incidents.