3 days ago
Seoul, Korea, SouthSenior / Staff+
Responsibilities
- Operate recurring vulnerability assessments for game and internal/external services, track remediation, and revalidate fixes.
- Integrate SAST, DAST, SCA, and secret detection into GitHub and GitLab CI/CD pipelines and automate remediation requests.
- Prioritize CVEs based on impact, reachability, and exploitability while managing remediation SLAs.
- Monitor and respond to open-source supply-chain attacks and establish SBOM, artifact-signing, and provenance-verification processes.
- Use LLMs and AI agents to automate detection classification, remediation guidance, recurring analysis, and reporting.
Requirements
- 5–8 years of professional experience in DevSecOps or application security.
- Experience integrating and operating SAST, DAST, and SCA checks in GitHub Actions or GitLab CI environments.
- Experience communicating vulnerability findings to development teams and tracking remediation through completion.
- Experience building or operating open-source software supply-chain security programs, including SBOM, dependency management, and malicious-package response.
- Ability to write or modify security automation scripts and tools in Python or another programming language.
- Experience using LLM or AI tools for security work, with the ability to explain, reproduce, and validate the results.
- No restrictions on overseas business travel.
- Preferred: experience analyzing real supply-chain attack incidents and establishing preventive controls.
- Preferred: experience implementing Sigstore or SLSA artifact signing and provenance.
- Preferred: experience customizing Semgrep, CodeQL, Trivy, or Dependency-Track and writing detection rules.
- Preferred: experience operating vulnerability-remediation and issue-tracker integrations at scale.
- Preferred: security experience with container images, Kubernetes, and IaC in CI/CD environments.
- Preferred: experience validating the supply-chain security of AI-agent tools such as MCP and plugins.
Benefits
- Full-time employment, subject to change based on the outcome of candidate employment-condition negotiations.
- Work location is Yeoksam Centerfield.
- A five-month probationary period applies, with no employment-type or salary changes during the period.
- The hiring process may vary by position or candidate, and the posting may close early once hiring is completed.
Tech Stack
Categories
About KRAFTON
KRAFTON is a Seoul-based, KRX-listed video game company that develops and publishes PC, console, and mobile titles. Its studios include PUBG Studios, Bluehole Studio, Striking Distance Studios, and Unknown Worlds, best known for the PUBG: Battlegrounds franchise (and PUBG Mobile with Tencent) and games like Subnautica and TERA. The company monetizes through premium sales and live-service content across global markets.