OKX

2 weeks ago

Senior/Staff Engineer, Security Platform Development

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 11 hours agoStatus: Live

Job Summary

Lead the development of core DevSecOps capabilities with a focus on security product development, platform engineering, and SDK/agent development. Own end-to-end DevSecOps architecture across code, builds, artifacts, deployments, and runtime security. Build Java-based RASP/agent protections using ASM/ByteBuddy and instrumentation, integrate scanning tools into CI/CD with closed-loop gating and remediation, and apply AI-native security engineering with LLMs and AI agents.

Location: Hong Kong, Singapore

Workplace: Onsite

Employment Type: Full time

Job Function: Solutions Engineering & Sales Engineering

Seniority: Mid level

Key Responsibilities

•Lead architecture and core development of an end-to-end DevSecOps platform, security products, and SDKs/Agents covering code, build, artifacts, images, deployment, and runtime security.
•Design and develop RASP/Java Agent runtime protection using ASM, ByteBuddy, and Java instrumentation for bytecode enhancement, runtime hooks, detection/blocking engines.
•Build and integrate SAST, DAST, IAST, SCA, and image/code security scanning into CI/CD workflows, including SonarQube and Coverity for scanning, gating, remediation, and re-validation.
•Deliver application security protections and offensive/defensive capabilities across XSS, SQL injection, SSRF, deserialization, command execution, authentication/authorization flaws, privilege escalation, and API security.
•Advance AI-native security engineering by using LLMs and AI Agents for vulnerability analysis, rule generation, false-positive reduction, remediation suggestions, security knowledge management, and workflow automation.

Pay and Benefits

Perks:Learning BudgetMeal AllowancesHealth InsuranceWellness Stipend

Key Requirements

•Strong fundamentals in computer science and security, including operating systems, networking, compilers/JVM internals, distributed systems, application security, and software supply chain security.
•Expert-level Java proficiency, especially JVM internals, ClassLoader, Java Agent, ASM, ByteBuddy, bytecode instrumentation, profiling, and performance tuning; proficient in Python or Golang.
•Hands-on experience with RASP, SAST, DAST, IAST, SCA, image security, and code security scanning; able to design, integrate, and productionize security capabilities.
•Strong offensive and defensive security experience, including vulnerability root causes, exploitation techniques, detection logic, bypass methods, and remediation strategies for web, API, and microservices.
•Practical experience applying LLMs and AI Agents to vulnerability analysis, rule generation, false-positive reduction, remediation suggestions, security knowledge management, and workflow automation.

Experience:CryptoSecurity engineering

Skills:OwnershipCommunicationCross-functional influenceEngineering mindsetProduct mindset

Languages:English

Tech Stack:JavaJVMClassLoaderASMByteBuddyJava InstrumentationRASPSASTDASTIASTSCACI/CDSonarQubeCoverityPythonGolangLLMsAI AgentsLLMBytecode instrumentation

Company Brief

OKX

Global cryptocurrency exchange and Web3 technology provider offering spot and derivatives trading, custody, wallet services, and blockchain infrastructure to retail and institutional users worldwide.

Industry: Trading Platforms

Company Size: Enterprise (1,001+ employees)

Growth: Established Company

Headquarters: Victoria, Seychelles

Founded: 2017

Website LinkedIn

Loading job details...

Preparing the role view and application actions.

OKX