About The Team

Shopee will be prioritizing applicants who have a current right to work in Singapore, and do not require Shopee sponsorship of a visa.

Kindly note that you can only be considered in one recruitment process at a time within Sea Group and will be considered for jobs in the order that you have applied.

The IT Compliance team acts as the organization's IT doctors, partnering with business teams to deliver technological solutions that enhance Shopee's user experience. A key focus is ensuring our product solutions meet regulatory standards by obtaining necessary certifications, achieved through close collaboration with internal and external stakeholders. This process not only ensures compliance but also provides the team with a deep understanding of regional business landscapes and cross-functional collaboration, enabling us to drive long-term, impactful solutions as the organization grows.

Job Description

Design and implement workflowbased control automation for Regulatory Standards (e.g., ISO, PCI) and SOX 404 ITGCs, using:

Explicit start–action–evidence–end flows.
Triggers from tickets, changemanagement systems, HR events, or IAM changes.
Delivered via tools such as n8n, Camunda, Azure Logic Apps, or custom MCPstyle servers.

Build and operate MCPstyle or MCPcompatible servers that expose:

Tools: RESTful endpoints for trigger evidence collection, run access review, validate change ticket, etc..
Resources: Standardized data sources (logs, IAM, ticket data) formatted for AI agents or workflow engines.
Auth patterns: API keys, bearer tokens, OAuth2, or OIDCstyle flows that can be consumed by agents or external tools.

Engineer APIfirst automation:

Write scripts and connectors (Python, Node.js, Bash, etc.) that call, compose, and orchestrate APIs from:

IAM, IdP, PAM, HRIS, ticketing, cloud IAM, and logging platforms, etc.
GRC platforms (e.g., ServiceNow, 6clicks, or similar) via REST APIs.

Implement:

Authentication and authorization (API keys, Bearer, OAuth2, JWT, Basic, MTLS).
Pagination, retry with backoff, ratelimiting, and safe error handling.
Idempotency and safe state transitions for auditcritical operations.

Translate ISO 27001 controls and SOX 404 ITGCs into automated workflows:

Example pattern:

Trigger: new user join or role change in IAM.
Action: call APIs to validate entitlements, crosscheck against SoD, and emit evidence to a GRC tool.
Outcome: workflowgenerated record for ISO 27001 access control and SOX logicalaccess control.

Maintain one source of truth for control logic (code / config) and use workflow IDs as controlevidence bindings.

Design AIagentready interfaces:

Expose structured, MCPstyle endpoints or OpenAPI specs so that LLM agents or workflow tools can call concrete tools (e.g., get latest access review for System X, run changeticketcompleteness check).
Handle dynamic policy enforcement: shortlived tokens, contextaware access, and audit logging for each AI or agent call.

Integrate with data platforms and SIEM/logging:

Use logs, change tickets, and identity events as workflow inputs.
Build automated tests for control effectiveness (e.g., if a production change is not approved, fire an alert and record as control failure) linked to ISO / SOX control IDs.

Maintain auditready workflow artifacts:

Log all workflow steps, including timestamps, input, user/agent context, and outputs.
Ensure workflow outputs are machinable (JSON, structured logs) and can be replayed or reasoned over by auditors or AI agents.

Requirements

Students currently pursuing Bachelor's degree in computer science, computer engineering or related disciplines.
Strong understanding of authorization and authentication:

API keys, Bearer tokens, OAuth2 (client, JWT, PKCE), Basic Auth, MTLS, and OIDCstyle flows.
Handson experience implementing these in Python, Node.js, or Go (or similar).

Deep practical experience with:

RESTful APIs: understanding of HTTP methods, status codes, pagination, ratelimiting, and idempotency.
API clients: writing or using libraries that handle auth, retries, and error handling for large datasets.

Experience building or integrating with:

Workflow / orchestration tools (n8n, Airflow, Logic Apps, Camunda, etc.) or MCPstyle servers / Model Context Protocolcompatible tooling.
GRC platforms via APIs (e.g., ServiceNow, 6clicks, or similar).

Familiarity with:

ISO 27001 (especially Annex A controls related to access management, change control, and operations).
SOX 404 ITGCs (logical access, change management, computer operations, data integrity).

Full-time interns preferred
Part-time interns who can commit at least 3 working days a week are also welcome to apply

Preferred Qualifications

OpenAPI / Swagger to MCPstyle tool generation (e.g., converting production APIs into MCP servers or AIagent tools).
Experience with MCP servers or similar controlplane architectures that expose tools, resources, and prompts for AI agents.
Background in security automation, CI/CD, or DevSecOps (number of tools: n8n, Terraform, Ansible, Docker, logging pipelines).
Prior involvement in SOX 404 audits and ISO 27001 certification projects, with a focus on how to automate evidence collection rather than manual spreadsheets.

Automation Compliance Engineer Intern, IT Compliance