Security Engineer, New Grad

If you are interested in more than one Supernova role, please apply to your first preference. We will still consider you for all opportunities.   Who We Are   OKX is revolutionising world systems through our cutting-edge digital asset exchange, Web3 portal and blockchain ecosystems. We are deeply committed to shaping a fairer, more transparent and accessible society through blockchain technology and to date, we have 50+ million users, 3000+ employees and 180+ countries believing in the same vision as us. We are safe and reliable, backed by our Proof of Reserves. As strong supporters of the Arts and Sports, we are proud partners of @McLarenF1 @ManCity @Tribeca.

•  

About OKX Graduate Program (Supernova) The Supernova Program is a 3-year Career Accelerator Program that aims to fast-track, high performing graduates into technical experts and future leaders mainly in the fields of Product Engineering, Product Management, and Product Design. We firmly believe in the power of the new era. Join us to achieve your narrative around crypto.   As a graduate Security Engineer, you will put in your utmost efforts to secure the OKX platform with millions of daily active users. You will work cross-functionally with design, product, and other engineering teams to identify and assess security risks, design and develop advanced security protective mechanisms and products or deliver high-quality thorough security operations and reinforcements. This is an opportunity to learn the full security life cycle of crypto and Web3 platforms and work along with a top-class security team fighting against worldwide security threats.  

What You’ll Be Doing

• Designing, developing, and maintaining high-performance backend systems and procedures to support the requirements of client security projects, regulatory, compliance, and infrastructure security best practices.
• Conducting security audits and vulnerability assessments, vulnerability scanning, and code reviews.
• Conducting routine checks and tests to ensure that all known vulnerabilities are detected and patched.
• Maintaining high-quality technical and organizational documentation. Upholding technology best practices and code reviews with peers. Improving efficiency in cross-office/time zone collaboration.
• Collaborate with team members and functional stakeholders to meet control requirements to demonstrate organizational security compliance
• Communicate and bridge the gap between external regulatory, audit requirements and internal stakeholder operations.
• Providing help and consulting to developers on secure coding practices.
• Optional directions include but are not limited to web security, network security, host and terminal security, data security, threat intelligence, SoC/SIEM/SOAR, Client Security, DevSecOps, etc., respecting personal interests and development intentions.

What We Look For In You

• Bachelors degree in Computer Science, Technology, Networking, MIS, Engineering, Mathematics, related technical and logical disciplines, or self-taught enthusiasts.
• Solid basic knowledge of security attack and defense, understanding common vulnerability principles and attack techniques, familiar with the best practices and common solutions of the defense side.
• Wholistic risk assessment skills to break down complex infrastructural and procedural issues to its basic principles for effective and controllable solutions.
• Compliance first mindset. Ability to lead by example for internal and external stakeholders. Highlight organizational best practices and embrace our We Before Me principle.
• Analytical with a positive problem-solving mindset, a proactive team player who embodies a growth mindset, flexible, and comfortable in navigating ambiguity with a global mindset.

Nice to Haves

• Comfortable with the cloud-based Linux environment. Knowledgeable in distributed architecture. Understanding of kubernetes or container orchestration architecture. Or familiar with daily developing tools such as npm, gulp, webpack, git.
• Possessing relevant tech stack skillset for the respective specialization - relational databases, OS, network computers, MIS operations, networking protocols, encryption, Identity and Access Management, Change Management/SDLC, cloud service architecture.
• AliCloud and AWS knowledge and certifications are a strong plus.
• Familiarity with security risk management and compliance frameworks (i.e. ISO 27001, NIST CSF, SOC 2 Common Criteria, CSA STAR)