Cybersecurity Engineer Intern (Web Security) - Spring 2027

About the role

Shopee's Engineering and Technology team builds the core of its platform, and is looking for a Cybersecurity Engineer Intern focused on web security for Spring 2027. The intern performs security assessments and penetration testing on web applications, APIs and internal systems, reviews code and architecture designs, helps build security automation and tooling, and supports vulnerability response and incident investigation.

Key responsibilities

• Perform security assessments and penetration testing on Shopee's web applications, APIs and internal systems, finding real exploitable issues and driving them to closure with engineering teams.
• Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives.
• Build and improve security automation and tooling, including in-house AI agents for security workflows, and SAST, DAST and SCA capabilities integrated into the development pipeline.
• Assess the security of AI-powered features and internal AI tooling, covering prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations.
• Support vulnerability response and incident investigation, track industry trends and share lessons learned with the team.

Required profile

• Currently pursuing a Bachelor's degree or above in Computer Science, Information Security, Cyberspace Security or a related field (preferred).
• Full-time interns (3-6 months) preferred; part-time interns committing at least 3 working days a week are also welcome.
• A fast learner who can communicate clearly and explain a vulnerability to engineers without a security background.

Required skills

• Solid networking and web fundamentals: L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and risks of common cryptographic misuse.
• Familiarity with the OWASP Top 10, including root causes, exploitation paths and remediation, and knowledge of vulnerabilities such as Fastjson and Log4j.
• Proficiency in at least one of Go, Java, Python, PHP, C or JavaScript, and ability to read design documents and business code.
• Basic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows.
• Awareness of AI/LLM security risks (OWASP Top 10 for LLM Applications).
• Preferred: understanding of SAST/DAST/SCA principles, CVEs in open-source projects, CTF or bug bounty experience, and experience building security tooling.