Web Offensive and Defensive Security Engineer

Responsibilities

• Security Assessment and Vulnerability Mining: Conduct comprehensive security assessment, penetration testing and vulnerability scanning of Web applications to identify potential security vulnerabilities and risk points (such as XSS, CSRF, SQL injection, SSRF, etc.).
• Security Design and Development Guidance: Provide professional security consulting and guidance during the product development lifecycle to assist the development team in designing and implementing a secure and reliable Web application architecture.
• Security Code Audit: Perform security audits on existing codes to discover and fix potential security defects.
• Security Defense System Construction: Participate in the construction and optimization of the company's security defense system, including but not limited to WAF policy configuration, deployment and maintenance of intrusion detection system (IDS)/intrusion prevention system (IPS), etc.
• Security Incident Response: Participate in the response, analysis and processing of security incidents, formulate and implement emergency plans, and reduce the impact of security incidents on the business.
• Security Awareness Training: Organize and participate in internal security awareness training to enhance the security awareness and skills of team members.
• New technology research: Keep an eye on the latest technologies and attack trends in the field of Web security, research and introduce advanced security protection measures.

Requirements

• Solid computer foundation: Familiar with basic knowledge such as network protocols (TCP/IP, HTTP/HTTPS, etc.), operating systems, databases, etc.
• Proficient in Web security attack and defense: In-depth understanding of the principles of common Web security vulnerabilities (such as OWASP Top 10) and their utilization and defense techniques.
• Proficient in security tools: Familiar with and able to skillfully use various Web security testing tools, such as Burp Suite, Nmap, Metasploit, etc.
• Programming ability: At least proficient in one or more programming languages (such as Python, Java, Go, PHP, etc.), able to develop security tools or write security automation scripts.
• Code auditing ability: Ability to perform security audits on common programming language codes
• Enterprise-level application security experience:
• Understand the security risks and protection of office collaboration systems (such as DingTalk, WeChat for Enterprise, Feishu, etc.), instant messaging tools and online conference systems. Those with relevant attack and defense experience are preferred.
• Familiar with intranet security architecture and common risks, and have experience in intranet penetration testing, including but not limited to intranet lateral movement, permission maintenance, domain penetration and other technologies.
• Familiar with data leakage prevention (DLP) technology and solutions, and able to identify and prevent sensitive data leakage risks.
• Problem-solving ability: Have excellent problem analysis and problem-solving skills, and be able to quickly locate and solve complex security problems.
• Learning ability and sense of responsibility: Have a strong willingness to learn and a sense of responsibility, and be able to withstand certain work pressure.
• Teamwork spirit: Good communication skills and teamwork spirit.

Nice to Have

• Have experience in CVE vulnerability reporting or winning security competitions.
• Familiar with container security, cloud security and other related technologies.
• Have experience in Web security work in large Internet companies.