[Security] Senior Application Security Engineer

About the company

Bybit is a major cryptocurrency exchange that is building MyBank, a retail-banking service meant to blend crypto trading with traditional financial services.

About this role

<div class="content-intro"><p><strong>About Us</strong></p> <div data-page-id="HladdPLXIoNz4nxkqkCuk4rAs8v" data-lark-html-role="root" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-XCikdRR2xoZIjdxtCKcuOflrs8d">Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance.</div> <div class="ace-line ace-line old-record-id-IF06dI0MPoBwYfxbZ4zui13HsoC">&nbsp;</div> <div class="ace-line ace-line old-record-id-X5EbdOwvMoYuOmxQBbuueUEDsDd">Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution.</div> <div class="ace-line ace-line old-record-id-LtVud2dO7oglqJxxZoOucqjJsPc">&nbsp;</div> <div class="ace-line ace-line old-record-id-RMHkdm4bPo66l3xMVO8ui1o8sle">Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services.</div> </div></div><div data-zone-id="0" data-line-index="0" data-line="true"> <div data-zone-id="0" data-line-index="0" data-line="true"> <div data-zone-id="0" data-line-index="0" data-line="true"> <div data-zone-id="0" data-line-index="0" data-line="true"> <div data-page-id="PRvcdzjJMo4fiExkkbsuSuBDsOf" data-lark-html-role="root" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-Th2wd1ecxoaCZFxPgUvutl7os2b"><strong>Job Summary:</strong></div> <div class="ace-line ace-line old-record-id-Ofindl0U0oxEHhxyAmnuwmams9f">&nbsp;</div> <div class="ace-line ace-line old-record-id-Zs3ZdUFIvoUKgFxLXnIud7xqshd">Primarily responsible for security auditing and security governance of the company's platform systems. Identify potential risks in business requirements and technical implementation plans, provide solutions, and drive their implementation.</div> <div class="ace-line ace-line old-record-id-XkAxdkDl9oqiSqxBUp5uWcDisg4">&nbsp;</div> <div class="ace-line ace-line old-record-id-Nj9edSzTdo0wtXxzrIuu6jXksTe"><strong>Job Responsibilities:</strong></div> <ol class="list-number1"> <li class="ace-line ace-line old-record-id-LGJtd9dEcoAJSAxUbMTuHJSUsUb" data-list="number"> <div>Conduct manual code security audits on business code (Java, Golang, JS, C++, etc.) and write audit reports.</div> </li> <li class="ace-line ace-line old-record-id-R2IydHtt1o3ifuxVbGLu8BFDsOd" data-list="number"> <div>Track domestic and international security developments; analyze and reproduce the latest security vulnerabilities.</div> </li> <li class="ace-line ace-line old-record-id-V1hLd5DUToX1LAxs4crunxLGssc" data-list="number"> <div>Deeply understand and master the company's product business; identify security risks in business architecture, business processes, and business logic; provide corresponding security solutions and drive their implementation.</div> </li> <li class="ace-line ace-line old-record-id-SUOedFxGPoMfYxxgrLiuwwcJsxd" data-list="number"> <div>Drive security solution implementation, risk governance, etc.</div> </li> </ol> <div class="ace-line ace-line old-record-id-XkhudEQf1oJVrnxewHuuINHms9c"><strong>Job Requirements:</strong></div> <ol class="list-number1"> <li class="ace-line ace-line old-record-id-Setud4deqovgqLxWdlauOjaHsnc" data-list="number"> <div>Associate degree or above; requirements may be relaxed for candidates with strong capabilities.</div> </li> <li class="ace-line ace-line old-record-id-QiWmdih1JoqAhlxEcuYuOBqGsaf" data-list="number"> <div>At least 3+ years of business development or audit experience based on Java or Go; has led or participated in SDL (Security Development Lifecycle) implementation.</div> </li> <li class="ace-line ace-line old-record-id-XH0hdnb1vo6uO9xtOrhuH2mpsPh" data-list="number"> <div>Proficient in the underlying principles, discovery methods, vulnerable code scenarios, and exploitation techniques of common security vulnerabilities (not limited to OWASP Top 10).</div> </li> <li class="ace-line ace-line old-record-id-Jr8BdjKIeoHJ1IxYekIulWvysgd" data-list="number"> <div>Expert-level proficiency in Java and/or Go tech stacks; understands language-specific characteristics and common mainstream development frameworks, with relevant code audit experience.</div> </li> <li class="ace-line ace-line old-record-id-EVQJdYxF2oLJyhxKt2vu1Fx6sAg" data-list="number"> <div>Familiar with common white-box audit methodologies, with the ability to track and reproduce the latest vulnerabilities.</div> </li> <li class="ace-line ace-line old-record-id-Apz1dQ0kpo38OJxcMznuXXDMswd" data-list="number"> <div>Familiar with mainstream development frameworks such as SpringMVC, SSM, or Gin, GoZero, etc.</div> </li> <li class="ace-line ace-line old-record-id-VO9Td3bgXo5WukxJZGOuWO34sGf" data-list="number"> <div>Has a solid understanding of penetration testing; proficient in common penetration testing methods and familiar with the principles and exploitation techniques of common vulnerabilities.</div> </li> <li class="ace-line ace-line old-record-id-U3Hrdnz3GoW64kxdESguGm4Us0b" data-list="number"> <div>Able to proficiently use AI tools to enhance security work efficiency.</div> </li> <li class="ace-line ace-line old-record-id-WyjrdVZMfod1XpxW6GcubRSns6T" data-list="number"> <d