3 months ago
Hong Kong, Hong Kong or Singapore, SingaporeSenior / Staff+
Responsibilities
- Lead architecture and core development of end-to-end DevSecOps platforms, security products, and SDKs/agents covering code, builds, artifacts, images, deployment, and runtime security.
- Design and develop RASP and Java Agent runtime protection using ASM, ByteBuddy, and Java Instrumentation.
- Build and integrate SAST, DAST, IAST, SCA, code security scanning, and image security scanning into development workflows, including SonarQube and Coverity integrations.
- Develop application security protections for XSS, SQL injection, SSRF, deserialization, command execution, authentication and authorization flaws, privilege escalation, and API security.
- Apply LLMs and AI Agents to vulnerability analysis, security rule generation, false-positive reduction, remediation suggestions, knowledge management, and workflow automation.
- Drive security standards, integration rules, quality gates, risk classification, remediation workflows, and governance adoption across business engineering teams.
- Collaborate with engineering, architecture, operations, QA, and business stakeholders to create scalable security products, engineering solutions, and governance mechanisms.
Requirements
- Expert-level Java proficiency, especially with JVM internals, ClassLoader, Java Agents, ASM, ByteBuddy, bytecode instrumentation, profiling, and performance tuning.
- Proficiency in Python or Golang.
- Deep knowledge of operating systems, networking, compilers, distributed systems, application security, cloud-native security, and software supply chain security.
- Hands-on experience designing, integrating, and productionizing RASP, SAST, DAST, IAST, SCA, image security, and code security scanning capabilities.
- Strong offensive and defensive security experience covering vulnerability causes, exploitation, detection, bypass methods, and remediation in web, API, and microservice environments.
- Practical experience with LLMs and AI Agents, including model architecture, agent design, tool invocation, context engineering, and evaluation methods.
- Experience leading or developing DevSecOps, application security, RASP, code scanning, or cloud-native security platforms is preferred.
- Experience in security product development, SDK or agent development, vulnerability research, penetration testing, red/blue team exercises, or incident response is preferred.
- Strong ownership, communication, product judgment, and cross-functional influence are required.
- Current right to work in Singapore without visa sponsorship is prioritized.
Benefits
- Learning and development programs and education subsidy
- Team-building programs and company events
- Wellness and meal allowances
- Comprehensive healthcare schemes for employees and dependants
- Applicants must have current right to work in Singapore and not require visa sponsorship
About OKX
OKX builds a global cryptocurrency exchange and Web3 wallet used by retail and institutional traders for spot, derivatives, and DeFi access, with developer APIs. Its business model centers on trading and financing fees, plus wallet and on-chain services. Founded in 2017 and privately held, OKX publishes monthly proof-of-reserves and operates as part of the OKG group serving crypto markets worldwide.