Staff Engineer, Security Platform Development at OKX

<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="Kpucdjv7JoAcSZxSf7PuRl5Yscb" data-lark-html-role="root" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-Cfb8dvi9voxFkWxhNcmuJX50sZb"> <div data-page-id="PNNZdiw4Yo1ZOmx8btbucw8qsLG" data-lark-html-role="root" data-docx-has-block-data="false"> <h2 class="heading-2 ace-line old-record-id-ARMWdtKDIowwlyxaSOuuzEqssIf"><strong>Who We Are</strong></h2> <div data-page-id="Kpucdjv7JoAcSZxSf7PuRl5Yscb" data-lark-html-role="root" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-Cfb8dvi9voxFkWxhNcmuJX50sZb">At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom.</div> <div class="ace-line ace-line old-record-id-Cfb8dvi9voxFkWxhNcmuJX50sZb">OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves.</div> <div class="ace-line ace-line old-record-id-Cfb8dvi9voxFkWxhNcmuJX50sZb">Across our multiple offices globally, we are united by our core principles:&nbsp;<em>We Before Me</em>, <em>Do the Right Thing</em>, and <em>Get Things Done</em>. These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er. OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more.</div> </div> </div> </div> <div class="ace-line ace-line old-record-id-Cfb8dvi9voxFkWxhNcmuJX50sZb"> <div data-page-id="PNNZdiw4Yo1ZOmx8btbucw8qsLG" data-lark-html-role="root" data-docx-has-block-data="false"> <h2 class="heading-2 ace-line old-record-id-PiRwdXFmiomeQDxx0RUuDGJ1sag"><strong>About the Opportunity</strong></h2> <div class="ace-line ace-line old-record-id-NrSYd8kjeoNTrexRDNsuNpZOsMd"> <div data-page-id="VDwDdku91ozeuUxUN78lwFbKgfc" data-lark-html-role="root" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-TVT4dwUpJonirGxFwJelqOu7gwb-translated">As a Staff Engineer, y<span class="_animating_yu34g_10" data-newtext-seq="0">ou'll own the </span><span class="_animating_yu34g_10" data-newtext-seq="15">build-out of our security engineering </span><span class="_animating_yu34g_10" data-newtext-seq="53">and DevSecOps capabilities: designing </span><span class="_animating_yu34g_10" data-newtext-seq="91">and developing the security </span><span class="_animating_yu34g_10" data-newtext-seq="119">products, platform services, and </span><span class="_animating_yu34g_10" data-newtext-seq="152">SDKs/Agents that embed protection </span><span class="_animating_yu34g_10" data-newtext-seq="186">directly into how code is </span><span class="_animating_yu34g_10" data-newtext-seq="212">written, built, shipped, </span><span class="_animating_yu34g_10" data-newtext-seq="237">and run.</span> <div class="_chunkWrapper_yu34g_39"> <p class="font-claude-response-body break-words whitespace-normal"><span class="_animating_yu34g_10" data-newtext-seq="0">This is a </span><span class="_animating_yu34g_10" data-newtext-seq="10">role for someone with </span><span class="_animating_yu34g_10" data-newtext-seq="32">real depth in security, </span><span class="_animating_yu34g_10" data-newtext-seq="56">broad coverage across the </span><span class="_animating_yu34g_10" data-newtext-seq="82">stack, and the engineering </span><span class="_animating_yu34g_10" data-newtext-seq="109">muscle to ship. Just as important is </span><span class="_animating_yu34g_10" data-newtext-seq="146">the ability to drive </span><span class="_animating_yu34g_10" data-newtext-seq="167">adoption — security that </span><span class="_animating_yu34g_10" data-newtext-seq="192">lands in complex, </span><span class="_animating_yu34g_10" data-newtext-seq="210">fast-moving business environments </span><span class="_animating_yu34g_10" data-newtext-seq="244">rather than sitting in a </span><span class="_animating_yu34g_10" data-newtext-seq="269">policy document.</span></p> <p class="font-claude-response-body break-words whitespace-normal">&nbsp;</p> </div> </div> </div> </div> <h2 class="heading-2 ace-line old-record-id-HytwdMMd1o5PQtxqi9QudDSMsWV"><strong>What You’ll Be Doing</strong><strong> </strong></h2> <ul class="list-bullet1"> <li class="ace-line ace-line old-record-id-GkWsdUpKpouMsxxrbMluoheLsQc" data-list="bullet"> <div><strong>Architect and build our end-to-end DevSecOps platform</strong> and the SDKs/Agents behind our security products, covering code, build, artifacts, images, deployment, and runtime.</div> </li> <li class="ace-line ace-line old-record-id-UkHxdmdcYotPMbxS4CUuUigns5s" data-list="bullet"> <div><strong>Lead runtime protection through RASP and Java Agent</strong> — bytecode instrumentation, runtime hooking, and detection/interception engines using ASM, ByteBuddy, and Instrumentation, with continuous tuning for performance, stability, and compatibility.</div> </li> <li class="ace-line ace-line old-record-id-WEUFd1hvcohl2KxgQFvukeJfsj8" data-list="bullet"> <div><strong>Integrate and productise scanning capabilities</strong> across SAST, DAST, IAST, SCA, code scanning, and image scanning. You'll embed tools like SonarQube and Coverity deep into CI/CD and close the loop from detection through blocking, remediation, and re-test.</div> </li> <li class="ace-line ace-line old-record-id-WEUFd1hvcohl2KxgQFvukeJfsj8" data-list="bullet"><strong>Go deep on application security offence and defence</strong> — designing detection, remediation, hardening, and counter-measures for XSS, SQL injection, SSRF, deserialisation, command execution, authentication/authorisation flaws, and API security.</li> <li class="ace-line ace-line old-record-id-WEUFd1hvcohl2KxgQFvukeJfsj8" data-list="bullet"><strong>Bring AI-native security engineering to life.</strong> Apply LLMs and AI Agents to vulnerability analysis, rule generation, false-positive attribution, remediation guidance, security knowledge capture, and engineering automation — and build a coherent view of the architecture, mechanics, and security implications.</li> <li class="ace-line ace-line old-record-id-WEUFd1hvcohl2KxgQFvukeJfsj8" data-list="bullet"><strong>Embed as the security technical expert inside engineering teams,</strong> driving security standards, onboarding specifications, release gates, risk tiering, and remediation mechanisms that measurably lift the security baseline and delivery quality.</li> <li class="ace-line ace-line old-record-id-WEUFd1hvcohl2KxgQFvukeJfsj8" data-list="bullet"><strong>Partner across engineering, architecture, SRE, QA, and business teams</strong> on priority projects, solving the genuinely hard security problems and turning the solutions into reusable platform capability and repeatable practice.</li> </ul> <h2 class="heading-2 ace-line old-record-id-ZvAmdvgIGoKyiHxjBTiu68Kcs9d"><strong>What We Look For In You&nbsp;</strong></h2> <ul class="list-bullet1"> <li class="ace-line ace-line old-record-id-F7Q5dSyFPonFgJx4HDKu09ObsMh" data-list="bullet"> <div><strong>Strong computer science and security fundamentals</strong> — deep understanding of operating systems, networking, compilers and the JVM, distributed systems, application security, cloud-native security, and supply chain security. Both breadth and depth.</div> </li> <li class="ace-line ace-line old-record-id-X2QpdbNA3okEKcxYKY3ufqOXsQh" data-list="bullet"> <div><strong>Expert-level Java,</strong> with hands-on depth in the JVM, ClassLoader, Java Agent, ASM, ByteBuddy, bytecode instrumentation, and performance profiling and tuning. Plus working proficiency in Python or Go.</div> </li> <li class="ace-line ace-line old-record-id-BUc6dfFyioKLJyxdlHGudKExsjg" data-list="bullet"> <div><strong>Substantial production experience with RASP, SAST, DAST, IAST, SCA, image security, and code scanning</strong> — enough to design a capability, integrate the engine, build the platform around it, and take it to scale independently.</div> </li> <li class="ace-line ace-line old-record-id-Xo0VdixCRoUklCxHTOXu6JBus0b" data-list="bullet"> <div><strong>Real offensive and defensive experience.</strong> You understand the root causes, exploitation paths, detection logic, bypass techniques, and fixes for common web, API, and microservices vulnerabilities — and can design from both the attacker's and defender's point of view.</div> </li> <li class="ace-line ace-line old-record-id-J5lMdPzOsooUWxxTU8PuJh7EsLf" data-list="bullet"> <div><strong>Fluency with LLMs and AI Agents,</strong> including a considered view on model capability limits, agent architecture, tool calling, context engineering, evaluation methods, and how AI is reshaping both security engineering and the attack surface.</div> </li> <li class="ace-line ace-line old-record-id-J5lMdPzOsooUWxxTU8PuJh7EsLf" data-list="bullet"><strong>Strong engineering execution paired with product instinct</strong> — able to lead the design and delivery of security products, platform modules, and SDKs/Agents while balancing security outcomes against performance overhead, integration cost, and long-term operability.</li> <li class="ace-line ace-line old-record-id-J5lMdPzOsooUWxxTU8PuJh7EsLf" data-list="bullet"><strong>Exceptional ownership,</strong> cross-team communication, and the persistence to move security governance, rule enforcement, and remediation through to a clear result.</li> </ul> <div class="ace-line ace-line old-record-id-UhJ9dmqAXoYf0Rxmj2MuiHGesRc">&nbsp;</div> <h2 class="heading-2 ace-line old-record-id-DiLSdqfwUoKOraxakB6uGEomsXl"><strong>Nice to Haves</strong></h2> <ul class="list-bullet1"> <li class="ace-line ace-line old-record-id-HCHYdH260obVbcxuNtZup7OhsDd" data-list="bullet"> <div>Security engineering experience at a top-tier internet company, cloud provider, or leading security vendor</div> </li> <li class="ace-line ace-line old-record-id-W5Pbd8H0RoIHBQxXZD0u5MhSsEf" data-list="bullet"> <div>You've led the build of a DevSecOps platform, application security platform, RASP, code scanning platform, or cloud-native security platform</div> </li> <li class="ace-line ace-line old-record-id-W5Pbd8H0RoIHBQxXZD0u5MhSsEf" data-list="bullet">Background in security product development, SDK/Agent engineering, vulnerability research, red team exercises, or purple team work</li> <li class="ace-line ace-line old-record-id-W5Pbd8H0RoIHBQxXZD0u5MhSsEf" data-list="bullet">Shipped AI + Security work — security copilots, intelligent rule generation, automated analysis, or remediation recommendation systems</li> </ul> <div class="ace-line ace-line old-record-id-Pyddd7YwWoyKAJxFqgSutn7YsFc">&nbsp;</div> <h2 class="heading-2 ace-line old-record-id-CmqsdZ2GTo6Z9VxuHx4ugzRRsm3"><strong>Perks &amp;<span style="font-size: 18pt;"> Benefits </span></strong></h2> <ul class="list-bullet1"> <li class="ace-line ace-line old-record-id-XvQudJ7z0ouSnuxOibouMkKzsCc" data-list="bullet"> <div>Competitive total compensation package</div> </li> <li class="ace-line ace-line old-record-id-GAzBdJXxLo291PxrthXurPeds4g" data-list="bullet"> <div>L&amp;D programs and Education subsidy for employees' growth and development</div> </li> <li class="ace-line ace-line old-record-id-CKPxdgHeoosenzxCpV2uV32ysz0" data-list="bullet"> <div>Various team building programs and company events</div> </li> <li class="ace-line ace-line old-record-id-XjPSdIa92oGeLox9Qo9uejVEs4c" data-list="bullet"> <div>Wellness and meal allowances&nbsp;</div> </li> <li class="ace-line ace-line old-record-id-CS34dAJCDoMDHxx95pZu43yjsxB" data-list="bullet"> <div>Comprehensive healthcare schemes for employees and dependants</div> </li> <li class="ace-line ace-line old-record-id-Uqtsd4bN8oaHt7xyPlYuxmfcsob" data-list="bullet"> <div>More that we love to tell you along the process!</div> </li> </ul> <div class="ace-line ace-line old-record-id-JGIsdeznCo2qpfxJAqkuViMfsHS">&nbsp;</div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div><div class="content-conclusion"><div data-lark-html-role="root"><span class="text-only" data-eleid="18"><span class="text-only"><span class="text-only" data-eleid="6">Notice:<br></span></span></span> <div data-lark-html-role="root"><span class="text-only" data-eleid="26"><span class="text-only">All official </span><span class="text-only text-with-abbreviation text-with-abbreviation-bottomline">OKX</span><span class="text-only"> vacancies are published on this website.</span></span> <span class="text-only" data-eleid="28"><span class="text-only">While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. </span></span><strong><span class="text-only" data-eleid="29"><span class="text-only">If in doubt, please apply directly through our official careers website.</span></span></strong></div> </div> <div data-lark-html-role="root"><span class="text-only" data-eleid="18"><span class="text-only">Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to&nbsp;</span><span class="text-only text-with-abbreviation text-with-abbreviation-bottomline">OKX</span><span class="text-only">'s </span></span><a class="link rich-text-anchor __anchor-intercept-flag__ text-content-link" href="https://www.okx.com/en-eu/help/okx-candidate-privacy-notice" target="_blank" data-eleid="19" data-lark-is-custom="true" data-lark-link="true">Candidate Privacy Notice</a><span class="text-only" data-eleid="20"><span class="text-only">.</span></span></div></div>