3 days ago
Singapore, SingaporeStaff+
Responsibilities
- Own daily triage of scanner, bug bounty, and penetration-testing findings, prioritize remediation using exploitability and business impact, and drive fixes to verified closure.
- Assess exposure to zero-day and newly disclosed vulnerabilities, coordinate urgent patching or mitigation, and track affected services through closure.
- Lead manual and AI-assisted penetration tests of web, API, mobile, and AI applications, including testing for prompt injection, jailbreaks, tool abuse, and data leakage.
- Design adversarial and automated security checks for CI/CD and adjust testing priorities based on AI-enabled attacker capabilities.
- Build and own production AI agents that automate application-security work and measure triage accuracy, time saved, and false-finding rates.
- Contribute to the AI AppSec roadmap, define AI autonomy and approval boundaries, and mentor junior analysts.
Requirements
- 6–10 years of experience in application security, product security, or offensive security, including strong web and API penetration-testing skills and vulnerability management at scale.
- Ability to validate and reproduce bug bounty and external researcher reports, recommend rewards, and prioritize remediation using CVSS, EPSS, KEV, and business context.
- Deep understanding of dependency and software supply-chain risks, including SCA and SBOM practices, with experience responding to zero-day and high-profile vulnerabilities across large engineering organizations.
- Hands-on experience building LLM tools or agents using Python, LLM APIs, RAG, or evaluation methods, and testing AI applications and agents.
- Demonstrated ability to mentor others and lead technical work across teams.
- Experience running or managing a bug bounty program, such as on HackerOne, is preferred.
- Experience fine-tuning or adapting models for security tasks, working with MCP servers, agent frameworks, AI red-teaming tools, CI/CD security automation, developer workflows, and cloud-native application security is preferred.
- Relevant certifications such as OSCP, OSWE, or GWAPT, published CVEs or research, and conference talks are advantageous.
Benefits
- The role is based in Singapore.
- Monthly base salary is SGD 10,900–16,300.
About Agoda
Agoda is a global online travel platform for booking hotels, homes, flights, and activities, serving travelers and accommodation partners worldwide. Its web and mobile marketplace matches demand and supply and monetizes through commissions and related partner services. Founded in 2005 and headquartered in Singapore, Agoda operates as a subsidiary of Booking Holdings, with extensive operations across Asia-Pacific markets.