Cybersecurity Engineer (Web Security) – Graduate

About the role

Shopee is looking for a motivated graduate to join its Information Security team as a Cybersecurity Engineer focused on web security. You will work closely with product and engineering teams to protect Shopee’s web applications, APIs, and AI‑powered features.

Key responsibilities

• Perform security assessments and penetration testing on web applications, APIs and internal systems, driving remediation with engineering teams.
• Review code and architecture designs to identify security flaws before release and embed security requirements into new initiatives.
• Develop and enhance security automation, including AI agents, SAST, DAST and SCA tools integrated into the CI/CD pipeline.
• Assess security risks of AI/LLM features such as prompt injection, data leakage and over‑permissive integrations.
• Support vulnerability response, incident investigation and stay current with industry trends.

Required profile

• Strong understanding of networking and web fundamentals (L4/L7 protocols, HTTP, TLS, session and authentication mechanisms).
• Familiarity with the OWASP Top 10 and ability to explain root causes and remediation for vulnerabilities like fastjson and log4j.
• Basic knowledge of business‑logic vulnerabilities (broken access control, authentication bypass, race conditions).
• Awareness of security risks in AI/LLM applications and curiosity about emerging attack surfaces.
• Clear communicator who can explain technical issues to non‑security engineers.

Required skills

• Proficiency in at least one programming language: Go, Java, Python, PHP, C or JavaScript.
• Experience with security testing tools: SAST, DAST, SCA.
• Knowledge of cryptographic misuse and secure session handling.
• Ability to script repetitive tasks for automation.
• Understanding of AI security concepts (prompt injection, tool misuse).