Information Security - Secure SDLC Engineer

Shopee; Singapore; On-site; SGD 90,000 - 180,000; Full time

Job summary

Shopee is seeking an experienced Security Engineer in Singapore to validate AI-discovered vulnerabilities, coordinate remediation with engineering, and drive timely fixes. The role will roll out the Secure SDLC across the development lifecycle, including SAST, DAST and SCA integrations to improve security quality and efficiency.

You will conduct security assessments of web apps, APIs and internal systems, design architecture-level security solutions, and build automation for security workflows

Qualifications

• Bachelor’s degree or above in Information Security, Computer Science or a related field.
• Solid understanding of OWASP Top 10 and web vulnerabilities; able to explain root cause, exploitation path, and remediation.

Responsibilities

• Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes.
• Drive rollout of Secure SDLC across the software development lifecycle, including SAST, DAST and SCA in the development pipeline.
• Participate in security reviews of business requirements and architecture designs; perform security assessments, testing and penetration testing of web apps, APIs and internal systems.
• Design security solutions at the architecture and system level; provide security support to business lines and drive implementation.
• Build and improve security automation and tooling, including in-house AI agents for security workflows.
• Assess security of AI-powered features and internal AI tooling; address prompt injection, unsafe tool calls, data leakage and over-permissive integrations.
• Support vulnerability response and incident investigation; keep up with industry trends to strengthen security posture.

Skills

Web fundamentals

Networking fundamentals

SDLC security

Programming languages

Vulnerability research

Code auditing

Security architecture

AI security

Communication

Collaboration

Education

Bachelor’s degree or above in Information Security / Computer Science

Job description

Job Description

• Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes;
• Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline, to improve SDLC quality and efficiency;
• Participate in security reviews of business requirements and architecture designs, and perform security assessments, testing and penetration testing of web applications, APIs and internal systems;
• Design security solutions at the architecture and system level, and provide security support to business lines and drive their implementation;
• Build and improve security automation and tooling, including in-house AI agents for security workflows, to scale coverage beyond manual review;
• Assess the security of AI-powered features and internal AI tooling, such as prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations;
• Support vulnerability response and incident investigation, and keep up with industry trends to continuously strengthen the company’s security posture.

Requirements

• Bachelor’s degree or above in Information Security, Computer Science or a related field, with at least 3 years of security-related experience at an internet company;
• Solid web and networking fundamentals: familiar with common web vulnerabilities and the OWASP Top 10, able to explain the root cause, exploitation path and correct remediation of each class, and understand L4/L7 protocols, HTTP, TLS, and session and authentication mechanisms;
• Hands-on experience in rolling out SDLC processes and building security programs on the in-house (enterprise) side, with SDLC experience at an internet company; experience independently leading SDLC adoption for a large business line is a plus;
• Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript, with development or security architecture experience and an understanding of common internet technology architectures and practices;
• Extensive experience in vulnerability research, code auditing and security solution design, with knowledge of industry standards and security frameworks;
• Solid understanding of core LLM and AI Agent concepts (context, prompts, tool calling and task decomposition) and hands-on AI for Security experience; aware of the security risks in AI/LLM applications (e.g. OWASP Top 10 for LLM Applications);
• Strong communication skills, cross-team collaboration and project-driving ability, able to explain vulnerabilities clearly to engineers without a security background.