Job description
Role Overview
Senior Application Security Engineer at Bybit, a leading cryptocurrency exchange and digital financial platform. The role is based at Bybit's global operations.
Company Overview
Established in 2018, Bybit is one of the world's leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. The company delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3. Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, backed by a global team of ambitious builders, problem-solvers, and innovators operating in a high-performance and fast-moving environment.
Role Purpose
Primarily responsible for security auditing and security governance of the company's platform systems. Identify potential risks in business requirements and technical implementation plans, provide solutions, and drive their implementation.
Key Responsibilities
Code Auditing
- Conduct manual code security audits on business code written in Java, Golang, JavaScript, C++, and other languages.
- Write detailed audit reports documenting findings and recommendations.
- Develop and demonstrate code audit experience across Java and Go environments.
Vulnerability Analysis and Research
- Track domestic and international security developments.
- Analyze and reproduce the latest security vulnerabilities.
- Maintain proficiency with common white-box audit methodologies.
- Track and reproduce the latest vulnerabilities as they emerge.
Risk Assessment and Solution Design
- Deeply understand and master the company's product business.
- Identify security risks in business architecture, business processes, and business logic.
- Provide corresponding security solutions.
- Have a solid understanding of penetration testing principles, methods, and exploitation techniques.
Implementation and Governance
- Drive security solution implementation.
- Lead risk governance initiatives.
- Participate in or lead Security Development Lifecycle (SDL) implementation.
Qualifications & Experience
- Associate degree or above; requirements may be relaxed for candidates with strong capabilities.
- At least 3 years of business development or audit experience based on Java or Go.
- Led or participated in SDL (Security Development Lifecycle) implementation.
- Expert-level proficiency in Java and/or Go tech stacks.
- Code audit experience with demonstrated results.
- Has submitted high-quality vulnerabilities to domestic or international SRC/bug bounty platforms (preferred).
- Has discovered CVE or CNVD general vulnerabilities (preferred).
- Experience with TEE (Trusted Execution Environment) and other security encryption, data protection technical architectures and solution implementation (preferred).
Skills & Competencies
- Proficient in the underlying principles, discovery methods, vulnerable code scenarios, and exploitation techniques of common security vulnerabilities, including but not limited to OWASP Top 10.
- Understands language-specific characteristics and common mainstream development frameworks.
- Familiar with mainstream development frameworks such as SpringMVC, SSM, Gin, and GoZero.
- Proficient in common penetration testing methods.
- Able to proficiently use AI tools to enhance security work efficiency.
- Highly proactive with strong logical thinking.
- Strong communication, coordination, and organizational skills.
- Demonstrated ability in documentation writing.
Additional Information
Benefits
- Study Growth Fund supporting professional development and continuous learning.
- Internal Events: Regular team-building activities, workshops, and events designed to promote collaboration and innovation.
- Global Collaboration: Work as part of a diverse, international team with colleagues from around the world.
- Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company.
- Internal Mobility: Long-term development opportunities with internal job opportunities to help build your career path.