Information Security - Secure SDLC Engineer

Shopee; Singapore; On-site; SGD 120,000 - 180,000; Full time

Job summary

Shopee's Engineering and Technology team in Singapore seeks a security-focused individual contributor to strengthen our secure SDLC and vulnerability management. You will validate AI-discovered vulnerabilities, drive fixes with engineering, and design security solutions at system level.

You will lead security reviews, perform assessments and penetration tests, and help scale security automation including in-house AI agents. Strong collaboration with cross-functional teams is essential to success.

Qualifications

• Bachelor’s degree or above in Information Security, Computer Science or a related field.
• 3+ years of security-related experience at an internet company.
• Solid web and networking fundamentals; OWASP Top 10 knowledge.
• Hands-on experience rolling out SDLC processes and security programs.
• Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript.

Responsibilities

• Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes.
• Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline.
• Participate in security reviews of business requirements and architectures and perform security assessments, testing and penetration testing of web apps, APIs and internal systems.
• Design security solutions at architecture and system level and provide security support to business lines.
• Build and improve security automation and tooling, including in-house AI agents for security workflows.
• Assess the security of AI-powered features and internal AI tooling; support vulnerability response and incident investigation.

Skills

Security experience

Secure SDLC

OWASP Top 10

Vulnerability research

Code auditing

AI/LLM security

Cross-team collaboration

Programming experience

Education

Bachelor’s degree in Information Security, Computer Science or related field

Tools

SAST

DAST

SCA

In-house AI agents

Job description

Department Engineering and TechnologyLevelExperienced (Individual Contributor)LocationSingaporeThe Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most \"innocent\" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.Job Description:Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes;Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline, to improve SDLC quality and efficiency;Participate in security reviews of business requirements and architecture designs, and perform security assessments, testing and penetration testing of web applications, APIs and internal systems;Design security solutions at the architecture and system level, and provide security support to business lines and drive their implementation;Build and improve security automation and tooling, including in-house AI agents for security workflows, to scale coverage beyond manual review;Assess the security of AI-powered features and internal AI tooling, such as prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations;Support vulnerability response and incident investigation, and keep up with industry trends to continuously strengthen the company’s security posture.Requirements:Bachelor’s degree or above in Information Security, Computer Science or a related field, with at least 3 years of security-related experience at an internet company;Solid web and networking fundamentals: familiar with common web vulnerabilities and the OWASP Top 10, able to explain the root cause, exploitation path and correct remediation of each class, and understand L4/L7 protocols, HTTP, TLS, and session and authentication mechanisms;Hands-on experience in rolling out SDLC processes and building security programs on the in-house (enterprise) side, with SDLC experience at an internet company; experience independently leading SDLC adoption for a large business line is a plus;Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript, with development or security architecture experience and an understanding of common internet technology architectures and practices;Extensive experience in vulnerability research, code auditing and security solution design, with knowledge of industry standards and security frameworks;Solid understanding of core LLM and AI Agent concepts (context, prompts, tool calling and task decomposition) and hands-on AI for Security experience; aware of the security risks in AI/LLM applications (e.g. OWASP Top 10 for LLM Applications);Strong communication skills, cross-team collaboration and project-driving ability, able to explain vulnerabilities clearly to engineers without a security background.