About The Team

Shopee will be prioritizing applicants who have a current right to work in Singapore, and do not require Shopee sponsorship of a visa.

Kindly note that you can only be considered in one recruitment process at a time within Sea Group and will be considered for jobs in the order that you have applied.

The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most innocent problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do.

Job Description

Perform security assessments and penetration testing on Shopee's web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams.
Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.
Build and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline.
Assess the security of AI-powered features and internal AI tooling — prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.
Support vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences.

Requirements

Solid networking and web fundamentals: a working understanding of L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and the risks introduced by common cryptographic misuse.
Familiar with the OWASP Top 10 — able to explain the root cause, exploitation path and correct remediation of each class; understands the mechanics and exploit chains of landmark vulnerabilities such as fastjson and log4j.
Proficient in at least one of Go, Java, Python, PHP, C or JavaScript; able to read design documents and business code, and to script your way out of repetitive work.
Basic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows.
Aware of the security risks in AI / LLM applications (e.g. the OWASP Top 10 for LLM Applications), with genuine curiosity about how AI is reshaping both the attack surface and the defender's toolkit.
A fast learner who communicates clearly — able to explain a vulnerability to engineers without a security background.

Preferred Qualifications

Interested in security engineering: understands the basic principles and limitations of SAST / DAST / SCA, and prefers building tools over repeating manual work.
CVEs credited in well-known open-source projects or general-purpose software, especially framework-level findings.
Placements in CTF competitions, or a consistent track record on SRC / bug bounty platforms.
Has built security tooling: scanners, fuzzers, SAST rules (Semgrep / CodeQL), Burp extensions, or LLM-based security automation and agents.
A security blog, GitHub projects, conference talks or published research.

Cybersecurity Engineer (Web Security) - Information Security