Cybersecurity Engineer (Web Security) - Information Security (2027 Graduate)

• Perform security assessments and penetration testing on Shopee's web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams.
• Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.
• Build and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline.
• Assess the security of AI-powered features and internal AI tooling - prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.
• Support vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences.

• Solid networking and web fundamentals: a working understanding of L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and the risks introduced by common cryptographic misuse.
• Familiar with the OWASP Top 10 - able to explain the root cause, exploitation path and correct remediation of each class; understands the mechanics and exploit chains of landmark vulnerabilities such as fastjson and log4j.
• Proficient in at least one of Go, Java, Python, PHP, C or JavaScript; able to read design documents and business code, and to script your way out of repetitive work.
• Basic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows.
• Aware of the security risks in AI / LLM applications (e.g. the OWASP Top 10 for LLM Applications), with genuine curiosity about how AI is reshaping both the attack surface and the defender's toolkit.
• A fast learner who communicates clearly - able to explain a vulnerability to engineers without a security background.

Preferred Qualifications:

• Interested in security engineering: understands the basic principles and limitations of SAST / DAST / SCA, and prefers building tools over repeating manual work.
• CVEs credited in well-known open-source projects or general-purpose software, especially framework-level findings.
• Placements in CTF competitions, or a consistent track record on SRC / bug bounty platforms.
• Has built security tooling: scanners, fuzzers, SAST rules (Semgrep / CodeQL), Burp extensions, or LLM-based security automation and agents.
• A security blog, GitHub projects, conference talks or published research.