{"id":1197390,"url":"https://alion.io/job/shopee-cybersecurity-engineer-web-security-information-security-2027-graduate","title":"Cybersecurity Engineer (Web Security) - Information Security (2027 Graduate)","company":{"id":49909,"name":"Shopee","domain":"shopee.com","url":"https://alion.io/company/shopee","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"A","score":100,"open_postings":27,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":12,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Singapore"],"countries":["SG"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":32000,"max_usd":61000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":34},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"JavaScript","optional":false},{"name":"LLM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PHP","optional":false},{"name":"Python","optional":false},{"name":"Burp Suite","optional":true},{"name":"CodeQL","optional":true},{"name":"GitHub","optional":true},{"name":"Semgrep","optional":true}],"status":"live","first_seen_at":"2026-09-24T19:12:45Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-10-27T10:28:47Z","board_verified":true,"closed_at":null,"days_open":32,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":32},"description":"Perform security assessments and penetration testing on Shopee's web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams.\nReview code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.\nBuild and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline.\nAssess the security of AI-powered features and internal AI tooling - prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.\nSupport vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences.\nSolid networking and web fundamentals: a working understanding of L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and the risks introduced by common cryptographic misuse.\nFamiliar with the OWASP Top 10 - able to explain the root cause, exploitation path and correct remediation of each class; understands the mechanics and exploit chains of landmark vulnerabilities such as fastjson and log4j.\nProficient in at least one of Go, Java, Python, PHP, C or JavaScript; able to read design documents and business code, and to script your way out of repetitive work.\nBasic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows.\nAware of the security risks in AI / LLM applications (e.g. the OWASP Top 10 for LLM Applications), with genuine curiosity about how AI is reshaping both the attack surface and the defender's toolkit.\nA fast learner who communicates clearly - able to explain a vulnerability to engineers without a security background.\nPreferred Qualifications:\nInterested in security engineering: understands the basic principles and limitations of SAST / DAST / SCA, and prefers building tools over repeating manual work.\nCVEs credited in well-known open-source projects or general-purpose software, especially framework-level findings.\nPlacements in CTF competitions, or a consistent track record on SRC / bug bounty platforms.\nHas built security tooling: scanners, fuzzers, SAST rules (Semgrep / CodeQL), Burp extensions, or LLM-based security automation and agents.\nA security blog, GitHub projects, conference talks or published research.","description_format":"text","description_chars":2518,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Commerce"],"lifecycle":[{"event":"open","at":"2026-09-24T19:12:45Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.402,"p_room":0.28,"age_days":32,"expected_fill_days":12,"reasons":["conf:3","velocity","win:tail","crowd:junior,brand"],"computed_at":"2026-10-27T05:46:45Z"},"pay":null,"html_url":"https://alion.io/job/shopee-cybersecurity-engineer-web-security-information-security-2027-graduate","json_url":"https://alion.io/job/shopee-cybersecurity-engineer-web-security-information-security-2027-graduate.json","meta":{"generated_at":"2026-10-27T12:39:25Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":413,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49909},"rest":"https://alion.io/mcp/rest/get_company?id=49909"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fshopee-cybersecurity-engineer-web-security-information-security-2027-graduate"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fshopee-cybersecurity-engineer-web-security-information-security-2027-graduate"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fshopee-cybersecurity-engineer-web-security-information-security-2027-graduate"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/shopee-cybersecurity-engineer-web-security-information-security-2027-graduate\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fshopee-cybersecurity-engineer-web-security-information-security-2027-graduate"}]}