上次的招聘信息发出后，很多同学问我，Shopee安全团队有没有Web安全、应用安全的岗位。这次大的就来了，因为我自己也是应用安全团队的，所以这个岗位和我是同一个部门同一个Team哦！

我们应用安全专家岗位，工作地点是深圳或新加坡，所以投递的时候最好跟我说明你想要base在哪个地点。

对于我们公司和我们团队的介绍，工作福利待遇等，可以点击下图查看我前面的文章：

应用安全岗位招聘JD如下（中文和英文版本）。

✅ 安全专家-SDLC方向

岗位职责

• 参与安全SDLC开发生命周期的落地工作，参与业务的安全方案评审、安全设计及技术评估
• 负责参与完善安全开发流程、体系化建设，制定相关安全标准和要求
• 输出安全解决方案和安全测试报告，针对其中漏洞输出修复方案并跟进落地
• 评估主流应用框架的风险点，制定安全方案为各业务线提供安全支持

岗位要求

• 本科及以上学历，5年以上相关工作经验
• 熟悉常见Web安全漏洞，对漏洞原理、利用与修复加固有深刻理解
• 熟悉甲方SDLC流程落地和安全建设，有互联网公司SDLC工作经验，曾独立负责大型业务线落地
• 熟练掌握黑盒测试方法和路径，能够独自完成源码审计工作，熟悉和实践过安全设计CheckList
• 熟悉Java、Python、PHP、Go、C等至少一种编程语言，能熟练阅读设计文档和相关代码
• 对常见的认证、越权、篡改等业务逻辑漏洞有了解，能够独立挖掘业务逻辑漏洞
• 在漏洞挖掘，代码审计及安全解决方案等方向有丰富经验

加分项

• 拥有著名开源或通用软件漏洞CVE，有框架层漏洞挖掘经验
• 参与过大型开源项目开发，熟悉团队开发流程与工具
• 具备流利的英文沟通能力，能够与跨国团队合作

✅ Expert Security Engineer - Secure Software Development Life Cycle (S-SDLC)

Key Job Responsibilities

• Participate in the implementation of secure Software Development Life Cycle (SDLC), and be responsible for the security solution reviews, security design and technical assessment for business departments
• Improve the secure SDLC, build the standard system, and formulate relevant security standards and requirements
• Produce security solutions and security test reports, provide advice in patching vulnerabilities and follow up with the risk mitigation
• Evaluate the risk points of mainstream application frameworks and develop security solutions to provide security support for each business line

Key Job Requirements

• Bachelor's degree in Computer Science, Engineering or related fields
• More than 5 years of relevant work experience
• Familiar with OWASP TOP 10 vulnerabilities, and have a deep understanding of the principle, utilisation, patching, and reinforcement of various vulnerabilities
• Familiar with the implementation of enterprise's SDLC process, have work experience in building secure SDLC for IT companies. Having been in charge of secure SDLC for a large dev team.
• Familiar with black box testing methods and paths, able to independently complete source code auditing work, have hands-on experience in security design checklist;
• Familiar with at least one programming language such as Java, Python, PHP, Go, C, etc., and proficient in reading design documents and related codes
• Having understanding in common business logic vulnerabilities such as authentication, ultra vires, and tampering, and experiences independently exploring business logic vulnerabilities would be a bonus
• Extensive experience in vulnerability mining, code auditing and security solutions Experience in vulnerability mining at the framework level is preferred

Bonus Points

• Having been credited to high-risk CVEs for well-known projects
• Having contributed to the development of open-source projects. Experience working in team collaborative development and familiar with development tools.
• Fluent English communication skills for effective collaboration with multinational teams

感兴趣的同学，可以在公众号后台联系我，或者直接将简历发送至我的邮箱：[email protected]