Staff Engineer, DevSecOps Platform

OKX; United States; On-site; USD 210,000 - 320,000; Full time

Benefits offered by this job

Competitive compensation package

L&D programs and Education subsidy

Team building programs and events

Wellness and meal allowances

Comprehensive healthcare for employees

Job summary

OKX is seeking a Staff Engineer to own the build-out of security engineering and DevSecOps capabilities across the code, build, artifacts, images, deployment, and runtime.

This role focuses on designing security products, platform services, SDKs/Agents, and embedding protection directly into how code is written, built, shipped, and run—requiring depth in security and the ability to drive adoption in a fast-moving business environment.

Qualifications

• Deep understanding of operating systems, networking, compilers and the JVM, distributed systems, application security, cloud-native security.
• Expert-level Java with hands-on depth in the JVM, ClassLoader, Java Agent, ASM, ByteBuddy, instrumentation, and performance tuning; Python or Go proficiency.

Responsibilities

• Architect and build our end-to-end DevSecOps platform and the SDKs/Agents behind security products.
• Lead runtime protection through RASP and Java Agent instrumentation with performance tuning.
• Integrate and productise scanning across SAST, DAST, IAST, SCA, image scanning into CI/CD; enable remediation loops.
• Design offense and defense strategies for web, API and microservices security vulnerabilities.
• Apply AI-native security engineering with LLMs and AI Agents for analysis, remediation guidance, and automation.
• Embed as the security technical expert inside engineering teams, driving standards and release gates.

Skills

Security fundamentals

Java & JVM expertise

Python/Go proficiency

DevSecOps platform design

AI & security knowledge

Security governance & ownership

Cross-team communication

Tools

SonarQube

Coverity

ASM

ByteBuddy

Instrumentation

Java Agent

Job description

OKX is seeking a Staff Engineer to own the build-out of security engineering and DevSecOps capabilities across the code, build, artifacts, images, deployment, and runtime.

This role focuses on designing security products, platform services, SDKs/Agents, and embedding protection directly into how code is written, built, shipped, and run—requiring depth in security and the ability to drive adoption in a fast-moving business environment.