Principal Security Operation Engineer
Location
Malaysia
Posted
5 days ago
Salary
0
Seniority
Lead
Job Description
Principal Security Operation Engineer
Bybit
Role Description - Responsible for developing and executing penetration testing, red-blue confrontation, and practical attack and defense drills that simulate real attack scenarios, identifying potential security risks in enterprise networks, applications, cloud environments, work networks, and core business systems. - Lead or participate in red-blue confrontation exercises to evaluate the defense team's ability in attack detection, alarm analysis, traceability analysis, emergency response, and recovery. - Based on the real attack chain design exercise scenario, covering: - Extranet breakthrough - Web vulnerability exploitation - Phishing entrance - Privilege escalation - Lateral movement - Data discovery - Privilege maintenance - Defense bypass stages - Combining the attack review results, promote the continuous optimization of security detection rules, response processes, asset governance, and security baselines. - Identify enterprise network exposure, internet assets, cloud assets, APIs, supply chain components, and third-party access risks, evaluate attack paths, and provide mitigation recommendations. - Monitor and collect threat intelligence, track vulnerability exploitation trends, APT attack methods, red team toolchain changes, and apply them to enterprise attack and defense exercises. - Combining business scenarios to model attack paths and discover feasible attack chains from external exposure surfaces to core assets. - Tracking AI-related security risks, including security issues in large-scale model applications, RAG systems, Agent systems, plug-in/tool calls, MCP services, AI code generation, and automated workflows. - Responsible for the security evaluation of AI applications, intelligent agent systems, RAG Knowledge Base, AI Agent toolchain, and model services within the enterprise. - Research and verify large-scale model-related attack techniques, including: - Prompt Injection - Jailbreak - Indirect Prompt Injection - Data leakage - Unauthorized tool invocation - Security risks caused by model illusions - RAG poisoning - Vector library pollution - Sensitive information leakage - Design AI red team test cases and evaluation framework, and conduct security verification on model input and output, context isolation, permission control, tool call chain, and data access boundary. - Participate in the construction of AI security protection plan, including: - Prompt word security policy - Content security detection - Tool call permission constraints - Sensitive data desensitization - Audit tracking - Agent sandbox isolation and security evaluation benchmark construction - Explore the application of AI in red team automation, vulnerability analysis, attack path planning, PoC verification, and report generation, and promote the platformization, automation, and intelligence of attack and defense capabilities. - Develop and optimize Red Team-specific tools and scripts for: - Vulnerability mining - Information collection - Privilege escalation - Lateral movement - Credential analysis - Traffic disguise - Defense bypass - Automated report generation - Research and validate new attack techniques, and simulate real threats in combination with enterprise business scenarios. - Build or participate in the construction of automated security evaluation platform, integrated vulnerability scanning, audio fingerprint recognition, asset mapping, PoC verification, attack path analysis, AI Agent arrangement and other capabilities. - Combining LLM/Agent technology to explore automated penetration testing, intelligent vulnerability verification, code security auditing, and red team task scheduling. - Conduct security evaluations on critical business systems, internal networks, cloud environments, work endpoints, API services, and AI applications, and output detailed technical reports, attack paths, impact analysis, and repair recommendations. - Output AI security evaluation reports for AI applications, including: - Attack examples - Risk levels - Exploitable paths - Data leakage risks - Permission boundary issues - Governance recommendations - Assist in improving enterprise security protection mechanisms, promote optimization of WAF, EDR, SIEM, NDR, HIDS, zero trust, identity permissions, and log auditing capabilities. - Transform attack and defense discovery into security detection rules, baseline specifications, develop security requirements, and continuous governance mechanisms. - Collaborate with the blue team, security operation, infrastructure, R&D, algorithm, data, and business teams to complete attack review, vulnerability repair, detection rule optimization, and security capability building. - Provide security support to other departments of the enterprise, including emergency response drills, development security consulting, AI application pre-launch security review, and security training. - Participate in the security design review of AI applications and security products, and promote the advance of security capabilities in R&D, testing, and Pushonline. Qualifications - Proficient in basic knowledge of cyber security, including TCP/IP protocol, network architecture, identity authentication, access control, principles and configurations of common security devices. - Proficient in common attack techniques and red team toolchains, such as Sliver, Cobalt Strike, NPS, Burp Suite, Metasploit, Nmap, Masscan, Frida, Impacket, etc. - Familiar with mainstream operating systems Windows, Linux, macOS security mechanism, log system, permission model and common use. - Familiar with common web frameworks, API architectures, microservice structures, containers, and security risks in Kubernetes environments. - Proficient in penetration testing and red team processes, including: - Information collection - Vulnerability scanning - Vulnerability exploitation - Intranet penetration - Privilege escalation - Lateral movement - Privilege maintenance - Data discovery - Trace cleaning - Familiar with the working principles and adversarial methods of enterprise-level security products, including WAF, EDR, SIEM, NDR, HIDS, zero-trust gateway, bastion host, and identity authentication system. - Possess independent vulnerability analysis and PoC writing capabilities, able to reproduce, verify, and assess the impact of public vulnerabilities and 0day/1day risks. - Proficient in one or more programming/scripting languages, such as Python, Go, Bash, PowerShell, JavaScript, etc., with experience in tool development and automation platform construction. - Familiar with the basic architecture of large-scale model applications, familiar with technical forms such as Prompt, RAG, Embedding, vector databases, Agent, Function Calling, MCP, plugin systems, etc. - Understand or practice AI security testing methods, including: - Prompt Injection - Jailbreak - RAG data poisoning - Sensitive information leakage - Unauthorized tool invocation - Model output security - Agent permission escape - Able to design security test cases for AI applications, evaluate model input/output, context isolation, data boundaries, permission control, and tool invocation chain risks. - Experience in using AI to assist security work, including: - Vulnerability analysis - Code auditing - Intelligence analysis - Attack path planning - Report generation - Automated testing - Familiar with AI application security governance ideas, including: - Model call auditing - Prompt word security - Sensitive data protection - Content security detection - Permission minimization - Sandbox isolation Requirements - More than 5 years of experience in red team, penetration testing, security research, or offensive and defensive exercises. - Candidates with experience in large-scale enterprise attack and defense drills, red-blue confrontation, HW/major support, cloud attack and defense, or intranet penetration are preferred. - Candidates with experience in AI security, large-scale model security, intelligent agent security, automated penetration testing platform or security tool platform construction are preferred. - Familiar with enterprise security construction system, able to promote defense capability, detection capability, and governance process optimization from an attack perspective. Other capabilities - Priority will be given to those who hold security-related certifications such as P, OSCE, CISSP, CISP, CEH, CISSP, CCSP, etc. - Possess strong document writing and expression abilities, able to output high-quality technical reports, review documents, attack chain analysis, and security construction plans. - Possess good problem analysis ability, learning ability, teamwork ability, and stress resistance. - Be sensitive to new technologies, new attack surfaces, and new tools, and be able to proactively research and share internally. Bonus points - Familiar with Cloud Computing Platform security and cloud attack and defense technologies, such as AWS, Azure, GCP, Tencent Cloud, Alibaba Cloud, etc. - Familiar with Kubernetes, containers, Service Mesh, CI/CD, DevSecOps and supply chain security. - Possess experience in zero trust, secure operation, threat hunting, attack surface management, and vulnerability management platform construction. - Familiar with MCP Server, AI Agent framework, RAG system, vector database, LLM API gateway, model security evaluation framework. - Experience in Automated Red Team, AI Penetration Testing, Intelligent Vulnerability Verification, Agent Orchestration, Security Knowledge Base or Security RAG System Construction. - Experience in vulnerability submission, CVE, technical articles, open source projects, topic sharing, or tool release in the security community. - Familiar with security frameworks such as MITRE ATT&CK, OWASP Top 10, OWASP LLM Top 10, NIST AI RMF, etc. Benefits - Study Growth Fund: We support your professional development and continuous learning. - Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation. - Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world. - Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company. - Internal Mobility: Grow with us - Your long-term development is important to us. We offer internal job opportunities to help build your career path.
Related Guides
Related Categories
Related Job Pages
More Security Engineer Jobs
Role Description The Sr. Security Engineer is responsible for testing physical, logical, and electronic protection of data, including: - Cloud - Corporate - Web application - Access control - Intrusion detection/prevention - Virus protection Additionally, the role involves: - Digital Forensics - Software Development - Vulnerability Research - Reverse Engineering - Software/Hardware Engineering - Operational Consultancy (e.g., Red Teaming/Hunt, Mission Evaluation) - Performing incident response - Working in the global security operations center - Identifying current and emerging cyber events - Developing countermeasures with known and/or discovered indicators Qualifications - Bachelor's degree preferred. Three additional years of related experience beyond the minimum may be substituted in lieu of a degree. - Three years of IT engineering experience - 5+ years of cybersecurity incident response participation (Preferred) - Certified Information Systems Security Professional (CISSP) certification (Preferred) - Knowledge of operating systems internals and endpoint security experience - General knowledge of APT campaigns, Tools, Techniques, & Procedures (TTP), malware attack vectors, memory injection techniques, and malware persistence mechanisms - Ability to obtain at least a Top Secret clearance Requirements - Resolve incidents and problem tickets, escalated to the Incident Response Team, issued against supported devices within published SLAs - Identify opportunities for process improvement and automation of repetitive tasks leveraging a SOAR platform - Operate security operations technology (SIEM/EDR) and provide ongoing system support and advice to other users of this technology - Devise and implement approaches to monitor applications and data flows via effective information dashboards for operational metrics, end-to-end system data processing, incident management, change control, and compliance - Use monitoring data in combination with other sources to analyze the risk of a successful attack - Proactively recommend new tools, techniques, and procedures to enhance SOC performance and quickly learn new tools as they are introduced - Actively search all areas of the internal network for hidden threats and vulnerabilities - Assist in the development and documentation of policies and processes - Support audits and compliance efforts - Participate in red/blue/purple team exercises as needed to analyze threat scenarios and assess internal defenses. Document results - Engage positively across multiple teams to establish clarity, vision, and mutual trust in order to achieve business goals - Adhere to industry-specific local, state, and federal regulations, as applicable - Other duties as assigned Benefits - Constellis offers a comprehensive, total rewards package that includes competitive compensation and a flexible benefits package that reflect its commitment to creating a diverse and supportive workplace.
• Manage, monitor, and maintain network security infrastructure with a focus on Fortinet solutions (FortiGate, FortiManager, FortiAnalyzer, FortiSwitch/FortiAP as applicable) • Perform day-to-day security operations: firewall policy management, VPN configuration and troubleshooting, traffic analysis, and incident response support • Design, implement, and maintain routing, switching, and network segmentation configurations in coordination with the client's network team • Monitor security events and logs, triage alerts, and escalate/respond to incidents per client protocols • Conduct firewall rule audits, policy optimization, and security posture reviews • Support patching, firmware upgrades, and change management processes for Fortinet devices • Troubleshoot complex network and security issues across LAN/WAN, VPN, and perimeter security layers • Document configurations, standard operating procedures, and incident reports • Collaborate with client stakeholders remotely, ensuring clear communication and timely delivery within the project's operational hours
Role Description The Cloud Security Engineer provides support for the implementation, troubleshooting, and maintenance of information security infrastructure and any process related to these systems in a Security Operations / IT Infrastructure environment. They will have a detailed understanding of cloud platforms, such as Microsoft Office 365 and Azure, on-premises infrastructure for policy maintenance, software/hardware security implementation and best practices, as well as scripting and relevant development skills to leverage automation and create custom connectors and analytics rules in a Microsoft Sentinel Environment. A successful candidate will also be well versed in security threats, exploits, and vulnerabilities which impact systems, networks, and assets and will utilize their abilities and experience to protect client environments. Thorough experience with Security Hardening across multiple products (Azure, O365, Active Directory), Endpoint Detection and Response technologies and understanding the implementation and support for those technologies is imperative to the success in this role. Essential Responsibilities (include but are not limited to): - Architect, establish and maintain best practices of implementation for our products/services. - Configure, implement, and support all production security tools and technologies. - Maintain excellent documentation (SOPs) for all security tooling implementation, support, troubleshooting, etc. - Troubleshoot issues with security toolsets within client environments. - Execute projects related to client onboarding – portal configuration, agent deployment, best practices configuration, systems auditing. - Actively work with other team members on security events that require urgent response, containment and remediation. - Provide ongoing recommendations on toolset tuning and best practices. - Ability to discuss security posture with multiple clients and make recommendations to better their holistic security approach. - Triage incoming support tickets and requests related to security tools managed by CyberSheath. - Take part in daily shift changeover meetings at the beginning and end of shifts. - Provide support for cloud-based SIEM, EDR, and Anti-Spam/Phishing products. - Provide support for additional security tools such as, but not limited to: SOAR, MFA, Encryption, and Vulnerability Management platforms. - Assist with triage of alerts as necessary. Qualifications - Minimum of 5 years’ experience with successful implementation of security products, security best practices, security device policies for small and large enterprises. - Minimum of 3 years' experience in Security Administration, and a deep understanding of how security interfaces/impacts with other IT teams/business objectives. - Deep understanding of Office 365 / Azure AD security tooling, policies and implementation, Azure AD / O365 reporting. - Networking understanding / working experience (TCP/IP, Routing, VPN). - Must be a U.S. Citizen and reside within the United States or its Territories. - Exceptional analytical and problem-solving skills. - Excellent communication skills to communicate with support personnel, customers, and managers. - Ability to work independently, remotely, and as part of a team. Requirements - Thorough working experience with the following products/technologies: KnowBe4, CrowdStrike, SAML/SSO, Okta, Intune, Cisco Umbrella, Rapid7, Defender for Endpoint, Defender for Office 365, Abnormal Security, Avanan. - Understanding of CIS (Center for Internet Security) benchmarks and implementation. - Working experience with DLP technologies/software (Office 365 native or third-party) is a plus. - Experience with Business Intelligence software for reporting (Power BI, BrightGauge, etc.). - Software development, coding, and/or advanced scripting experience is a plus. - Working expertise with Microsoft Sentinel, Google Chronicle, or Splunk. - Certifications related to Microsoft Azure and Microsoft Security products. Work Environment - Remote. - Please note that this role will be part of our SOC on-call rotation. Budgeted Pay Range $85,000 — $100,000 USD
Role Description We are looking for a hands-on Security Lead with strong technical depth to define, operationalize, and scale Apheris’ security capabilities. You will own cloud and application security, incident response, IT and corporate security, and security tooling across our environment. You will collaborate closely with engineering, product, and leadership, ensuring that security is embedded throughout our systems, operations, and development processes. You will maintain and evolve the unified security control framework, build scalable security processes, and lead efforts to detect, respond to, and remediate threats. Your focus is on anticipating risks, enabling teams, and ensuring that security is a natural part of day-to-day work. If you thrive at the intersection of technical depth, operational excellence, and cross-functional collaboration, while also influencing architecture, processes, and culture, this role is for you. What you will do - Own cloud and application security, including AWS security architecture, IAM, network security, and secure configuration management. - Drive and continually improve application security practices, including secure coding guidance, threat modeling support, and automated security testing in the SDLC. - Lead the incident response program, including playbook development, on-call readiness, threat detection, and response coordination. - Manage vulnerability management processes, ensuring risks are identified, triaged, and remediated effectively with engineering teams. - Maintain and evolve security tooling, including monitoring, logging, SIEM/alerting, and secrets management. - Collaborate with engineering and platform teams to embed security considerations into design and architectural decisions. - Contribute to the unified control framework, ensuring strong security foundations for ISO 27001 and SOC 2. - Own corporate and IT security, including endpoint management (e.g., MDM), identity and access management, and oversight of the external IT provider. - Lead security reviews by our customers, acting as a confident, trusted partner to enterprise clients throughout their evaluation process. - Stay ahead of emerging threats, technologies, and best practices to continuously uplift Apheris’ security posture. Qualifications - A degree in computer science, engineering, or equivalent hands-on experience in technical roles. - 5+ years of experience in security engineering, cloud security, application security, or similar technical security roles. - Hands-on expertise with AWS security architecture, identity and access management, network security, and modern DevOps practices. - Experience implementing or supporting secure development lifecycle (SDLC) practices, collaborating closely with engineering. - Strong understanding of modern authentication, authorization, secrets management, and infrastructure-as-code security. - Demonstrated experience handling security incidents, vulnerability management, or threat detection. - Demonstrated experience with large-enterprise security and compliance expectations, including how major corporates conduct security reviews and vendor due-diligence processes. - Experience maintaining compliance programs such as ISO 27001 or SOC 2. - Ability to build strong relationships across engineering and influence secure design decisions. - A pragmatic, solution-oriented mindset that balances security, usability, and speed. - Experience mentoring team members and helping them grow their security skills. Nice to have - Experience acting as a Data Protection Officer or supporting regulation like GDPR. - Experience leading and developing teams, with the ability to mentor others and scale a security function in a fast-growing environment. - Understanding of pharma deployment environments and integrations with common R&D platforms (e.g., Schrödinger Live Design, Benchling). - Experience working in B2B SaaS environments, particularly with AI-powered or data-intensive products, and an understanding of the security considerations that come with them. - Experience working directly with external partners, customers, and users in fast-moving, high-stakes projects. What we offer you - Industry-competitive compensation, including early-stage virtual share options. - Remote-first working – work where you work best. - Wellbeing budget, mental health support, work-from-home budget, co-working stipend, and learning budget. - Generous holiday allowance. - Office Days at our Berlin HQ or a different European location (3x per year). - A high-caliber, execution-focused team with experience from leading organizations.
