Security Engineer, Risk Adversary and Intel Discovery (TikTok BRIC)

About the role

TikTok BRIC is a global team protecting ByteDance users, platform health and the authenticity of its community and business ecosystems, covering account and content integrity and safety across advertising and e-commerce. The RAID (Risk Adversary and Intelligence Discovery) team within this group focuses on understanding and countering adversarial activities across underground ecosystems by combining threat intelligence research, adversary analysis and offensive security assessments. The role shapes the trust, safety and sustainable growth of ByteDance's global platforms.

Key responsibilities

• Research underground industry chains, adversarial groups, abnormal business activities and emerging attack trends, and use intelligence techniques such as adversary attribution and threat intelligence monitoring to give actionable risk warnings.
• Analyze illicit tools, cheating software and attack techniques, reconstruct attack paths and identify vulnerabilities and gaps in existing risk controls.
• Run adversarial simulations against business systems to test the effectiveness of current defenses and recommend improvements.
• Collect and correlate intelligence from internal and external sources, including OSINT, to identify adversarial groups and trace attack origins.
• Map and monitor underground industry chains targeting critical business scenarios, and track security trends and incidents to support rapid response.
• Turn intelligence findings into defense strategies and work with cross-functional teams to improve risk detection, mitigation and control.

Required profile

• Solid understanding of underground ecosystems, adversarial groups, industry chains, attack techniques and monetization models, able to analyze business risks independently.
• Familiarity with core risk control strategies and mechanisms, and with common web, mobile and system vulnerabilities.
• Strong analytical thinking and risk awareness, able to correlate information across sources and solve complex problems.

Required skills

• At least one of: Android/iOS/Web reverse engineering, mobile app security, abuse and cheating techniques, fake engagement, incentive abuse or other adversarial attacks.
• Proficiency in at least one major programming language such as Python, Go, Java, C/C++ or JavaScript, with basic data analysis and mining skills.
• Preferred: threat intelligence collection and analysis (including OSINT), enterprise Red Team, penetration testing or vulnerability discovery experience, and a track record of submitting high-impact vulnerabilities.