Information Security - Secure SDLC Engineer

SHOPEE SINGAPORE PRIVATE LIMITED; Singapore; On-site; SGD 90,000 - 150,000; Full time

Job summary

Shopee Singapore Private Limited is seeking an experienced security engineer to validate AI-driven vulnerabilities, drive remediation with engineering teams, and lead Secure SDLC adoption across web apps, APIs, and internal systems.

You will design architecture-level security solutions, build automation and AI-powered security tooling, and assess AI features for potential risks. Strong collaboration and communication are essential in this globally distributed team.

Qualifications

• Bachelor’s degree in Information Security, Computer Science, or a related field.
• At least 3 years of security-related experience at an internet company.
• Strong web and networking fundamentals; knowledge of OWASP Top 10.
• Experience rolling out SDLC processes and building security programs in-house.
• Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript.
• Extensive experience in vulnerability research, code auditing and security solution design.
• Solid understanding of LLM and AI Agent concepts and AI security risks.
• Strong communication and cross-team collaboration skills.

Responsibilities

• Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes;
• Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline, to improve SDLC quality and efficiency;
• Participate in security reviews of business requirements and architecture designs, and perform security assessments, testing and penetration testing of web applications, APIs and internal systems;
• Design security solutions at the architecture and system level, and provide security support to business lines and drive their implementation;
• Build and improve security automation and tooling, including in-house AI agents for security workflows, to scale coverage beyond manual review;
• Assess the security of AI-powered features and internal AI tooling, such as prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations;
• Support vulnerability response and incident investigation, and keep up with industry trends to continuously strengthen the company’s security posture.

Skills

Vulnerability research

Security program leadership

Strong communication

Cross-team collaboration

Threat modeling

Education

Bachelor’s degree in Information Security or CS

Tools

SAST tooling

DAST tooling

SCA tooling

AI agents

Job description

The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.

Job Description:

• Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes;
• Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline, to improve SDLC quality and efficiency;
• Participate in security reviews of business requirements and architecture designs, and perform security assessments, testing and penetration testing of web applications, APIs and internal systems;
• Design security solutions at the architecture and system level, and provide security support to business lines and drive their implementation;
• Build and improve security automation and tooling, including in-house AI agents for security workflows, to scale coverage beyond manual review;
• Assess the security of AI-powered features and internal AI tooling, such as prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations;
• Support vulnerability response and incident investigation, and keep up with industry trends to continuously strengthen the company’s security posture.

Requirements:

• Bachelor’s degree or above in Information Security, Computer Science or a related field, with at least 3 years of security-related experience at an internet company;
• Solid web and networking fundamentals: familiar with common web vulnerabilities and the OWASP Top 10, able to explain the root cause, exploitation path and correct remediation of each class, and understand L4/L7 protocols, HTTP, TLS, and session and authentication mechanisms;
• Hands-on experience in rolling out SDLC processes and building security programs on the in-house (enterprise) side, with SDLC experience at an internet company; experience independently leading SDLC adoption for a large business line is a plus;
• Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript, with development or security architecture experience and an understanding of common internet technology architectures and practices;
• Extensive experience in vulnerability research, code auditing and security solution design, with knowledge of industry standards and security frameworks;
• Solid understanding of core LLM and AI Agent concepts (context, prompts, tool calling and task decomposition) and hands-on AI for Security experience; aware of the security risks in AI/LLM applications (e.g. OWASP Top 10 for LLM Applications);
• Strong communication skills, cross-team collaboration and project-driving ability, able to explain vulnerabilities clearly to engineers without a security background.