Security Research Engineer 安全研发工程师

About us

Bitget is the world's largest Universal Exchange (UEX), serving over 125 million users and offering access to over 2M crypto tokens, 100+ tokenized stocks, ETFs, commodities, FX, and precious metals such as gold. The ecosystem is committed to helping users trade smarter with its AI agent, which co-pilots trade execution.

Bitget is driving crypto adoption through strategic partnerships with LALIGA and MotoGP™. Aligned with its global impact strategy, Bitget has joined hands with UNICEF to support blockchain education for 1.1 million people by 2027. Bitget currently leads in the tokenized TradFi market, providing the industry's lowest fees and highest liquidity across 150 regions worldwide.

What you'll do

• Responsible for the design and development of the core components of the zero-trust system, including identity authentication, access proxy, policy engine, etc.;
• Responsible for the architecture design and development of security gateways and security middleware, implementing authentication, rate limiting, protection and auditing capabilities at the traffic layer;
• Participated in the research and iteration of RASP products, implementing runtime attack detection and blocking (such as deserialization, JNDI injection, command execution, memory horse, etc.) based on Java Agent and bytecode enhancement technology;
• Ensured the high availability and low intrusion of security components in the production environment, continuously optimizing performance overhead, compatibility and fault fallback capabilities;
• Followed up on new attack methods and vulnerabilities in the Java ecosystem, converting them into detection rules and protection capabilities;
• Participated in technical solution reviews, promoting the integration and implementation of security capabilities in business systems;
• Actively used AI tools to improve development efficiency, participated in the construction of team AI engineeringization, including internal MCP services, Skill specifications and the implementation of Agent in the R&D process, and paid attention to the security risks introduced by the introduction of AI applications.

What you'll need

• Bachelor's degree or above, major in cybersecurity, information security, computer science, etc.; 5 years of Java development experience, with at least 2 years of experience in the research and development of security products or security infrastructure;
• Have in-depth research and development experience in at least two of the following areas: zero trust, security gateway, security middleware, RASP; Familiar with protocols and mechanisms such as mTLS, OAuth2/OIDC, JWT;
• Familiar with the principles and exploitation chains of common Java vulnerabilities, including deserialization, JNDI injection, expression injection, SSRF, memory carriages, etc.;
• Have design and development experience for high-concurrency and high-availability systems, familiar with Netty, NIO and asynchronous programming models, and have practical experiences in circuit breakers, gray release, capacity assessment, etc. for stability assurance;
• Proficient in using tools such as JFR, async-profiler, Arthas for performance analysis, and have experience in troubleshooting online issues;
• Have a deep understanding of JVM principles, including class loading mechanism, bytecode structure, JIT, memory model and GC tuning; Familiar with Java Agent/Instrumentation, and proficient in using at least one of ASM, ByteBuddy, Javassist;
• Understand the principles of Maven/Gradle build, familiar with dependency conflict handling, shade/relocate, class isolation, etc.;
• Proficient in using AI programming tools such as Claude Code, Cursor to assist in development, have practical experience with Agent, Skill, MCP; Have experience in promoting team AI efficiency improvement, or be familiar with AI security risks such as Prompt injection, MCP permission control, etc.;
• Those with the following experiences are preferred: have experience in multiple language development, such as Go/Rust language development, Kubernetes / Service Mesh, eBPF / JVMTI, WAF / IAST / API security product development, as well as contributions to security open-source projects, CVE or security conference topics.

岗位职责：

• 负责零信任体系核心组件的设计与研发，包括身份认证、访问代理、策略引擎等模块;
• 负责安全网关及安全中间件的架构设计与开发，在流量层实现鉴权、限流、防护与审计能力;
• 参与 RASP 产品研发与迭代，基于 Java Agent 及字节码增强技术实现运行时攻击检测与阻断（如反序列化、JNDI 注入、命令执行、内存马等）;
• 保障安全组件在生产环境中的高可用与低侵入，持续优化性能开销、兼容性及故障降级能力;
• 跟踪 Java 生态的新型攻击手法与漏洞，将其转化为检测规则与防护能力;
• 参与技术方案评审，推动安全能力在业务系统中的接入与落地;
• 积极运用 AI 工具提升研发效率，参与团队 AI 工程化建设，包括内部 MCP 服务、Skill 规范及 Agent 在研发流程中的落地，并关注 AI 应用引入的安全风险。

任职要求：

• 本科及以上学历，网络安全、信息安全、计算机等相关专业优先; 5 年以上 Java 研发经验，其中 2 年以上安全产品或安全基础设施研发经验;
• 在零信任、安全网关、安全中间件、RASP 中至少两个方向有深入研发经验，熟悉 mTLS、OAuth2/OIDC、JWT 等协议与机制;
• 熟悉 Java 常见漏洞原理及利用链，包括反序列化、JNDI 注入、表达式注入、SSRF、内存马等;
• 具备高并发、高可用系统的设计与研发经验，熟悉 Netty、NIO 及异步编程模型，有熔断降级、灰度发布、容量评估等稳定性保障实践;
• 熟练使用 JFR、async-profiler、Arthas 等工具进行性能分析，具备线上问题排查经验;
• 深入理解 JVM 原理，包括类加载机制、字节码结构、JIT、内存模型及 GC 调优; 熟悉 Java Agent / Instrumentation，熟练使用 ASM、ByteBuddy、Javassist 中的至少一种;
• 理解 Maven / Gradle 构建原理，熟悉依赖冲突处理、shade/relocate、类隔离等问题;
• 熟练使用 Claude Code、Cursor 等 AI 编程工具辅助研发，对 Agent、Skill、MCP 有实践经验; 有推动团队 AI 提效经验，或了解 Prompt 注入、MCP 权限控制等 AI 安全风险者优先;
• 有以下经验者优先：有多种语言开发经验，如Go/Rust 语言开发、Kubernetes / Service Mesh、eBPF / JVMTI、WAF / IAST / API 安全产品研发，以及安全开源项目贡献、CVE 或安全会议议题。

Why Bitget?

• Bitget is the world's leading web 3 platform for copy trading and one of the world's largest and most respected exchanges
• We are a global company with staff members from over 50 different countries and regions
• We are growing and looking for world-class ambitious talents to help us continue this journey
• We have a streamlined structure that empowers employees to work efficiently, delivering the best results in a short timeframe
• We offer competitive salaries and benefits
• Blockchain technology and digital assets have the potential to change finance in a way no other technology can - be part of it!

If you are ambitious and believe that digital assets could be the next financial and technological revolution, please apply!

For more information regarding candidates' personal data processing, please refer to Bitget Candidate Privacy Notice.