job description
Join Shopee, Southeast Asia’s leading e-commerce platform, as a Cybersecurity Engineer (Web Security) in our 2027 Graduate Program. This is a unique opportunity for emerging cybersecurity talent to work on cutting-edge security challenges while protecting millions of users across the region. Based in Bali, Indonesia (with flexible remote options in Canggu, Ubud, Denpasar, Jimbaran, Nusa Dua, Kuta, or Badung), you’ll collaborate with global security teams to safeguard Shopee’s web applications, APIs, and internal systems from evolving cyber threats.
In this role, you’ll conduct penetration testing, vulnerability assessments, and security audits to identify and mitigate risks in real-time. You’ll work closely with development and DevOps teams to integrate security best practices into the software development lifecycle (SDLC), ensuring robust protection against OWASP Top 10 vulnerabilities, injection attacks, and other web-based threats. This position is ideal for a 2027 graduate with a passion for cybersecurity, ethical hacking, and proactive threat defense.
Shopee offers a dynamic, fast-paced environment where your contributions will have a direct impact on the security of one of the region’s most innovative tech companies. You’ll receive mentorship from industry experts, access to advanced security tools, and opportunities to grow your career in a high-growth industry. If you’re eager to make a difference in cybersecurity while enjoying Bali’s vibrant tech community, we’d love to hear from you!
Responsibility
- Conduct penetration testing and security assessments on Shopee’s web applications, APIs, and internal systems to identify exploitable vulnerabilities.
- Perform vulnerability scanning and risk analysis to prioritize and remediate security gaps in collaboration with development teams.
- Develop and implement security automation scripts to enhance threat detection and response capabilities.
- Collaborate with DevOps and engineering teams to integrate security best practices into CI/CD pipelines (e.g., SAST/DAST tools).
- Investigate and respond to security incidents, including root cause analysis and remediation planning.
- Stay updated on emerging cybersecurity threats and industry trends, recommending proactive measures to mitigate risks.
- Assist in security awareness training for employees and stakeholders to promote a security-first culture.
- Document security findings, reports, and recommendations for technical and non-technical audiences.
Qualifications
- Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field (graduating in 2027).
- Foundational knowledge of web security principles, including OWASP Top 10, SQL injection, XSS, CSRF, and API security.
- Hands-on experience with penetration testing tools (e.g., Burp Suite, OWASP ZAP, Metasploit, Nmap) or bug bounty programs is a plus.
- Familiarity with programming/scripting languages (e.g., Python, JavaScript, Bash) for security automation.
- Understanding of network security, encryption protocols, and secure coding practices.
- Strong analytical and problem-solving skills with attention to detail.
- Excellent communication skills to articulate security risks and solutions to cross-functional teams.
- Certifications such as CEH, OSCP, CompTIA Security+, or willingness to pursue them are advantageous.