Cybersecurity Engineer (Security Operations)

About the role

Xiaomi is looking for a Cybersecurity Engineer focused on security operations for its international business. The role covers the lifecycle of core security solutions, real-time monitoring, API security, vulnerability management and compliance with regional regulations.

Key responsibilities

• Manage the full lifecycle of core security solutions (WAF, MiShield, HIDS), configuring policies, optimizing rules and expanding coverage to protect web and mobile applications against threats such as the OWASP Top 10
• Develop real-time monitoring and alerting frameworks that analyze security logs, detect anomalous traffic and attacks, produce root-cause analysis reports and improve defense strategies
• Contribute to an API security framework, including abnormal behavior detection models and access control to prevent unauthorized data access and API abuse
• Integrate API security with gateways and microservices, use SAST/DAST tools to promote shift-left security and set developer security guidelines
• Oversee vulnerability management (scanning, risk assessment, remediation) and work with R&D teams on code-level fixes
• Monitor global threat intelligence and zero-day vulnerabilities, run red/blue team exercises and refine emergency response protocols
• Ensure compliance with regulations such as GDPR and Singapore PDPA, prepare audit reports and support international business units, local compliance teams and third-party vendors with security training

Required profile

• Bachelor's degree or higher in Computer Science, Information Security or a related field
• Ability to communicate effectively in English and Mandarin

Required skills

• Expertise in operating security products such as WAF and IDS
• Proficiency in API security design and protection, including OWASP API Top 10 and gateway security policy deployment
• Familiarity with vulnerability management tools and processes (e.g. Nessus, Burp Suite)
• Proficiency in Python and Shell scripting
• Knowledge of international data security regulations and compliance requirements