Web Offensive and Defensive Security Engineer

Binance is a leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. We are trusted by over 250 million people in 100+ countries for our industry-leading security, user fund transparency, trading engine speed, deep liquidity, and an unmatched portfolio of digital-asset products. Binance offerings range from trading and finance to education, research, payments, institutional services, Web3 features, and more. We leverage the power of digital assets and blockchain to build an inclusive financial ecosystem to advance the freedom of money and improve financial access for people around the world.

Responsibilities

• Security Assessment and Vulnerability Mining: Conduct comprehensive security assessment, penetration testing and vulnerability scanning of Web applications to identify potential security vulnerabilities and risk points (such as XSS, CSRF, SQL injection, SSRF, etc.).
• Security Design and Development Guidance: Provide professional security consulting and guidance during the product development lifecycle to assist the development team in designing and implementing a secure and reliable Web application architecture.
• Security Code Audit: Perform security audits on existing codes to discover and fix potential security defects.
• Security Defense System Construction: Participate in the construction and optimization of the company's security defense system, including but not limited to WAF policy configuration, deployment and maintenance of intrusion detection system (IDS)/intrusion prevention system (IPS), etc.
• Security Incident Response: Participate in the response, analysis and processing of security incidents, formulate and implement emergency plans, and reduce the impact of security incidents on the business.
• Security Awareness Training: Organize and participate in internal security awareness training to enhance the security awareness and skills of team members.
• New technology research: Keep an eye on the latest technologies and attack trends in the field of Web security, research and introduce advanced security protection measures.

Requirements

• Solid computer foundation: Familiar with basic knowledge such as network protocols (TCP/IP, HTTP/HTTPS, etc.), operating systems, databases, etc.
• Proficient in Web security attack and defense: In-depth understanding of the principles of common Web security vulnerabilities (such as OWASP Top 10) and their utilization and defense techniques.
• Proficient in security tools: Familiar with and able to skillfully use various Web security testing tools, such as Burp Suite, Nmap, Metasploit, etc.
• Programming ability: At least proficient in one or more programming languages (such as Python, Java, Go, PHP, etc.), able to develop security tools or write security automation scripts.
• Code auditing ability: Ability to perform security audits on common programming language codes
• Enterprise-level application security experience:
• Understand the security risks and protection of office collaboration systems (such as DingTalk, WeChat for Enterprise, Feishu, etc.), instant messaging tools and online conference systems. Those with relevant attack and defense experience are preferred.
• Familiar with intranet security architecture and common risks, and have experience in intranet penetration testing, including but not limited to intranet lateral movement, permission maintenance, domain penetration and other technologies.
• Familiar with data leakage prevention (DLP) technology and solutions, and able to identify and prevent sensitive data leakage risks.
• Problem-solving ability: Have excellent problem analysis and problem-solving skills, and be able to quickly locate and solve complex security problems.
• Learning ability and sense of responsibility: Have a strong willingness to learn and a sense of responsibility, and be able to withstand certain work pressure.
• Teamwork spirit: Good communication skills and teamwork spirit.

Nice to Have

• Have experience in CVE vulnerability reporting or winning security competitions.
• Familiar with container security, cloud security and other related technologies.
• Have experience in Web security work in large Internet companies.

Why Binance• Shape the future with the world’s leading blockchain ecosystem• Collaborate with world-class talent in a user-centric global organization with a flat structure• Tackle unique, fast-paced projects with autonomy in an innovative environment• Thrive in a results-driven workplace with opportunities for career growth and continuous learning• Competitive salary and company benefits• Work-from-home arrangement (the arrangement may vary depending on the work nature of the business team)
Binance is committed to being an equal opportunity employer. We believe that having a diverse workforce is fundamental to our success.By submitting a job application, you confirm that you have read and agree to our Candidate Privacy Notice.