Responsibilities
- Lead architecture and core development of end-to-end DevSecOps platforms, security products, and SDKs/agents covering code, builds, artifacts, images, deployment, and runtime security.
- Design and develop RASP and Java Agent runtime protection using ASM, ByteBuddy, and Java Instrumentation.
- Build and integrate SAST, DAST, IAST, SCA, code security scanning, and image security scanning into development workflows, including SonarQube and Coverity integrations.
- Develop application security protections for XSS, SQL injection, SSRF, deserialization, command execution, authentication and authorization flaws, privilege escalation, and API security.
- Apply LLMs and AI Agents to vulnerability analysis, security rule generation, false-positive reduction, remediation suggestions, knowledge management, and workflow automation.
- Drive security standards, integration rules, quality gates, risk classification, remediation workflows, and governance adoption across business engineering teams.
- Collaborate with engineering, architecture, operations, QA, and business stakeholders to create scalable security products, engineering solutions, and governance mechanisms.
Requirements
- Expert-level Java proficiency, especially with JVM internals, ClassLoader, Java Agents, ASM, ByteBuddy, bytecode instrumentation, profiling, and performance tuning.
- Proficiency in Python or Golang.
- Deep knowledge of operating systems, networking, compilers, distributed systems, application security, cloud-native security, and software supply chain security.
- Hands-on experience designing, integrating, and productionizing RASP, SAST, DAST, IAST, SCA, image security, and code security scanning capabilities.
- Strong offensive and defensive security experience covering vulnerability causes, exploitation, detection, bypass methods, and remediation in web, API, and microservice environments.
- Practical experience with LLMs and AI Agents, including model architecture, agent design, tool invocation, context engineering, and evaluation methods.
- Experience leading or developing DevSecOps, application security, RASP, code scanning, or cloud-native security platforms is preferred.
- Experience in security product development, SDK or agent development, vulnerability research, penetration testing, red/blue team exercises, or incident response is preferred.
- Strong ownership, communication, product judgment, and cross-functional influence are required.
- Current right to work in Singapore without visa sponsorship is prioritized.
Benefits
- Learning and development programs and education subsidy
- Team-building programs and company events
- Wellness and meal allowances
- Comprehensive healthcare schemes for employees and dependants
- Applicants must have current right to work in Singapore and not require visa sponsorship
About OKX
At OKX, we believe that the future will be reshaped by Crypto, ultimately contributing to every individual's freedom. OKX began as a crypto exchange giving millions of people access to crypto trading and over time becoming among the largest platforms in the world. In recent years, we have developed one of the most connected Web3 wallets used by millions to access decentralized crypto applications (dApps). OKX is a trusted brand by hundreds of large institutions seeking access to crypto markets on a reliable platform that seamlessly connects with global banking and payments. In the last year, OKX has expanded into new markets including Australia, Brazil, Netherlands, Singapore and Turkey, with plans to launch in the US, Belgium and the UAE. We are deeply committed to shaping a fairer, more transparent and accessible society through blockchain technology. This is why we publish proof of reserves monthly, and continue to ship new innovative security features. We believe in good sportmanship and the pursuit to be better. You may see our OKX logo neatly fitted on the McLaren F1 cars, Manchester City FC team shirts, or at the Tribeca Film Festival celebrating artists and creators. Wherever you may find us, you will notice our pursuit of making our world more efficient, transparent, and connected. To learn more about OKX, download our app or visit: www.okx.com UK users follow: https://www.linkedin.com/company/okxuk/ Learn more about working at OKG, the business group developing OKX, our Digital Assets Exchange, our Web3 portal and blockchain ecosystems: bit.ly/WorkingatOKG