Information Security Engineer – Security Operations

Overview

We are seeking an Information Security Engineer specializing in Security Operations to manage and enhance the security posture of Xiaomi’s international business portfolio. This role involves overseeing core security technologies, designing API security frameworks, managing vulnerabilities, and ensuring compliance with global data protection standards.

Key Responsibilities

• Manage the full lifecycle of security solutions such as WAF, MiShield, and HIDS, including policy configuration, rule optimization, and expanded coverage to safeguard web and mobile applications from prevalent threats like those identified in OWASP Top 10.
• Develop real-time monitoring and alerting systems; analyze security logs for anomalous activities; perform root cause analysis; and improve defense tactics accordingly.
• Lead the creation of an API security framework focused on international operations to provide comprehensive protection for interfaces, incorporating models for behavioral anomaly detection and access controls to thwart unauthorized access and abuse.
• Collaborate with API gateways and microservices, integrate SAST/DAST tools to promote shift-left security approaches, and establish security guidelines for developers.
• Manage end-to-end vulnerability processes including scanning, risk evaluation, and remediation, particularly for high-risk vulnerabilities; work closely with development teams on code-level fixes.
• Monitor global threat intelligence and new vulnerabilities, conduct regular red/blue team exercises, and continually refine incident response procedures.
• Ensure that all security operations conform to data protection regulations such as GDPR and Singapore PDPA; prepare documentation for compliance audits.
• Work jointly with international business units, local compliance teams, and external vendors to provide security support and training as required.

Required Qualifications and Skills

• Bachelor’s degree or higher in Computer Science, Information Security, or a related discipline.
• Strong experience with security operation products including WAF and IDS.
• Expertise in API security design and protection, including familiarity with OWASP API Top 10 threats and deployment of security policies on API gateways.
• Knowledge of vulnerability management tools like Nessus and Burp Suite, with capability to reproduce and verify vulnerability remediation.
• Proficiency in scripting languages such as Python and Shell; experience developing security automation solutions is advantageous.
• Understanding of international data privacy laws and compliance standards; proven ability to work effectively with cross-regional teams.
• Fluency in English and Mandarin, both verbal and written, is mandatory; certifications like CISSP or CSSLP are a plus.
• Strong sense of responsibility, excellent analytical and problem-solving skills, and readiness to handle unforeseen security incidents.