Information Security - Secure SDLC Engineer
Job Description
Job Description
- Validate vulnerabilities discovered by AI, communicate remediation plans with engineering teams, and drive timely fixes;
- Drive the rollout of the Secure SDLC across the software development lifecycle, including SAST, DAST and SCA capabilities integrated into the development pipeline, to improve SDLC quality and efficiency;
- Participate in security reviews of business requirements and architecture designs, and perform security assessments, testing and penetration testing of web applications, APIs and internal systems;
- Design security solutions at the architecture and system level, and provide security support to business lines and drive their implementation;
- Build and improve security automation and tooling, including in-house AI agents for security workflows, to scale coverage beyond manual review;
- Assess the security of AI-powered features and internal AI tooling, such as prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations;
- Support vulnerability response and incident investigation, and keep up with industry trends to continuously strengthen the company's security posture.
- Bachelor's degree or above in Information Security, Computer Science or a related field, with at least 3 years of security-related experience at an internet company;
- Solid web and networking fundamentals: familiar with common web vulnerabilities and the OWASP Top 10, able to explain the root cause, exploitation path and correct remediation of each class, and understand L4/L7 protocols, HTTP, TLS, and session and authentication mechanisms;
- Hands-on experience in rolling out SDLC processes and building security programs on the in-house (enterprise) side, with SDLC experience at an internet company; experience independently leading SDLC adoption for a large business line is a plus;
- Proficient in at least one programming language such as Java, Python, PHP, Go, C or JavaScript, with development or security architecture experience and an understanding of common internet technology architectures and practices;
- Extensive experience in vulnerability research, code auditing and security solution design, with knowledge of industry standards and security frameworks;
- Solid understanding of core LLM and AI Agent concepts (context, prompts, tool calling and task decomposition) and hands-on AI for Security experience; aware of the security risks in AI/LLM applications (e.g. OWASP Top 10 for LLM Applications);
- Strong communication skills, cross-team collaboration and project-driving ability, able to explain vulnerabilities clearly to engineers without a security background.
More Info
Key Skills
AI for Security
security solution design
L7 protocols
authentication mechanisms
About Company
Skills:
Static Application Security Testing (SAST), Software Composition Analysis (SCA), security automation , Git, AI-assisted development tools, dependency management, Code security, Vulnerability analysis, CI/CD