Web Offensive and Defensive Security Engineer

Summary

Join Binance, a leading global blockchain ecosystem, and contribute to the security of our platform. As a Web Application Security Engineer, you will conduct security assessments, penetration testing, and vulnerability scanning. You will also provide security design and development guidance, perform security code audits, and participate in incident response. Your responsibilities include constructing and optimizing our security defense system and conducting security awareness training. This role requires a strong understanding of web security principles and experience with various security tools. You will also need programming and code auditing abilities. The ideal candidate will have experience in enterprise-level application security and a proven ability to solve complex security problems.

Requirements

• Familiar with basic knowledge such as network protocols (TCP/IP, HTTP/HTTPS, etc.), operating systems, databases, etc
• In-depth understanding of the principles of common Web security vulnerabilities (such as OWASP Top 10) and their utilization and defense techniques
• Familiar with and able to skillfully use various Web security testing tools, such as Burp Suite, Nmap, Metasploit, etc
• At least proficient in one or more programming languages (such as Python, Java, Go, PHP, etc.), able to develop security tools or write security automation scripts
• Ability to perform security audits on common programming language codes
• Understand the security risks and protection of office collaboration systems (such as DingTalk, WeChat for Enterprise, Feishu, etc.), instant messaging tools and online conference systems
• Familiar with intranet security architecture and common risks, and have experience in intranet penetration testing, including but not limited to intranet lateral movement, permission maintenance, domain penetration and other technologies
• Familiar with data leakage prevention (DLP) technology and solutions, and able to identify and prevent sensitive data leakage risks
• Have excellent problem analysis and problem-solving skills, and be able to quickly locate and solve complex security problems
• Have a strong willingness to learn and a sense of responsibility, and be able to withstand certain work pressure
• Good communication skills and teamwork spirit

Responsibilities

• Conduct comprehensive security assessment, penetration testing and vulnerability scanning of Web applications to identify potential security vulnerabilities and risk points (such as XSS, CSRF, SQL injection, SSRF, etc.)
• Provide professional security consulting and guidance during the product development lifecycle to assist the development team in designing and implementing a secure and reliable Web application architecture
• Perform security audits on existing codes to discover and fix potential security defects
• Participate in the construction and optimization of the company's security defense system, including but not limited to WAF policy configuration, deployment and maintenance of intrusion detection system (IDS)/intrusion prevention system (IPS), etc
• Participate in the response, analysis and processing of security incidents, formulate and implement emergency plans, and reduce the impact of security incidents on the business
• Organize and participate in internal security awareness training to enhance the security awareness and skills of team members
• Keep an eye on the latest technologies and attack trends in the field of Web security, research and introduce advanced security protection measures

Preferred Qualifications

• Have experience in CVE vulnerability reporting or winning security competitions
• Familiar with container security, cloud security and other related technologies
• Have experience in Web security work in large Internet companies

Benefits

• Competitive salary and company benefits
• Work-from-home arrangement (the arrangement may vary depending on the work nature of the business team)