Senior Security Engineer

Humanity • Full Time • Hong Kong, HK • 12h ago

About the Role

You will be the hands-on security engineer working directly under our Head of Security, owning the security of our cloud infrastructure and the detection and response capability that protects the exchange and its business units.

You will harden AWS to a defensible baseline, build the detection pipeline that catches attackers, stop initial access, lead incident response during Hong Kong hours, and use LLM-driven agents (Strix, Cairn-style harnesses, Claude / GPT-based tooling) to automate the offensive testing and triage.

What You will Do

1. Cloud and Infrastructure Hardening

Own the security posture of AWS: IAM least privilege, SCPs and Organizations guardrails, VPC segmentation, KMS and secrets management, CIS benchmarks, and infrastructure-as-code review.
Harden Kubernetes and containerised workloads: admission control, image signing, runtime policy, network policy, and workload identity.
Operate a CSPM / CNAPP platform (Wiz, Prisma Cloud, AWS Security Hub or similar) and drive misconfiguration findings to closure with engineering.
Own identity and access as the first line of defence: phishing-resistant MFA, conditional access, just-in-time privileged access, service-account and API-key lifecycle, and ongoing access reviews
Define and enforce the change-management and deployment controls that prevent process failures from becoming incidents: break the glass procedures, production changes.

2. Detection and Response

Build and tune detection in the log system: log coverage across CloudTrail, GuardDuty, Kubernetes audit, EDR, identity provider, VPN and SaaS.
Build exchange-specific detections: withdrawal-flow anomalies, API-key abuse, admin-panel misuse, hot and cold wallet movements on-chain, and insider-threat signals
Operate EDR / XDR (CrowdStrike, SentinelOne or Microsoft Defender) across endpoints, servers and cloud workloads, including the response playbooks
Own incident response end-to-end during Hong Kong hours and non-office hour: From triage, containment, cloud and host forensics, communication, post-mortems, lesson learn and coordination with our managed detection provider

3. AI Offensive Security

Run autonomous AI pentest agents (Strix, Cairn-style harnesses, or equivalent) against exchange APIs, web and mobile frontends, admin panels and cloud infrastructure.
Lead purple-team exercises that replay realistic attack paths: AI-agent-driven initial access, API-key theft, withdrawal-logic bypass, account takeover, and insider threat; close the gaps found and measure detection coverage before and after
Use LLMs to scale security operations: alert summarisation, log query generation, detection-rule fine tuning.

4. Exchange and Security Code Review

Conduct deep-dive source code reviews of exchange Infrastructure, prioritizing MPC/HSM integrations and withdrawal approval logic.
Inspect the source code and on-chain monitoring tools to ensure secure data handling and robust integration with detection pipelines.
Triage and manually validate findings from SCA & SAST & DAST, and secrets-scanning tools to recommend secure code remediations.

Requirements

5+ years in security engineering, with at least 3 years hands-on in cloud security on AWS, and at least 1 year at a crypto exchange, custodian or high-value fintech
Detection engineering experience: you have written and tuned SIEM detections as code, measured false-positive rates, and can show detections in real world attack.
Incident response experience in cloud environments: you have led at least one real incident through containment, forensics and post-mortem, and can walk through it
Hands-on experience with autonomous or LLM-driven security tooling: you have run AI pentest agents (Strix, Cairn-style harnesses, XBOW or equivalent) or built LLM-assisted
Experience deploying and operating an EDR / XDR platform and a CSPM
Working knowledge of exchange attack paths: API-key abuse, withdrawal-flow bypass, account takeover, and the basics of wallet architecture (MPC / HSM, hot / cold flows)
OSCP is highly preferable, also one the following: AWS Certified Security, Professional Cloud Security Engineer, CKS, GCIH, GCFA.
Fluent in Cantonese is a strong advantage for working with local teams

Similar Jobs

Site Reliability Engineer - Global Financial Institution - Hong Kong

NLS Executive Search • Full Time • Hong Kong, HK • 2h ago

Engineering Full Time

Our client, a global buy side institution, are seeking an SRE to design, build and maintain automation and analytical solutions that detect, investigate and resolve data‑quality issues. You will author production‑grade P...

2h ago

Apply

Senior Backend Engineer - Leading Digital Bank

PFCC Group • Full Time • Hong Kong, HK • 10h ago

Engineering Full Time

Our client is a leading digital banking institution redefining the future of financial services through technology, innovation, and customer-centric solutions. As they continue to scale their engineering capabilities and...

10h ago

Apply

Data Engineer - Tier one global hedge fund - Open to Hong Kong and Singapore

BAH Partners • Full Time • Hong Kong, HK • 14h ago

Engineering Full Time

Industry: Hedge Fund | Trading Technology | Data Engineering We are working with a rapidly expanding global multi-strategy hedge fund that is making significant investments in its trading technology and data infrastructu...

14h ago

Apply

AI Engineer

Octopus Holdings Limited • Full Time • Hong Kong, HK • 15h ago

Engineering Full Time

Born from Hong Kong's demand for fast, convenient, and reliable payment solutions, Octopus introduced the world's first contactless multi-modal transit payment system in 1997. Since then, this homegrown FinTech company h...

15h ago

Apply

Safety officer

BUDA Surveying Limited • Full Time • Yuen Long, Hong Kong, HK • 1d ago

Engineering Full Time

1. RSO qualifications 2. Site operations experience 3. Will double up as pc/APM/pm depends on qualifications and experiences We offer internal & external training to right candidate. Interested parties please send de...

1d ago

Apply

大偈 / 機械維修技工 (大埔/坪輋)

K. Wah Construction Materials (Hong Kong) Limited • Full Time • Tai Po, Hong Kong, HK • HK$ 30,000 / month • 1d ago

Engineering Full Time

工作職責及要求: 負責混凝土廠房的機械維修及燒焊工作有責任心、勤奮及工作態度良好持有效平安咭, 中工牌及氣體焊接安全訓練課程證明書具備2年以上相關工作經驗者優先考慮工作地點、工作日及時間：工作地點：大埔 6天工作日（星期...

1d ago

Apply

冷氣技術員 (本公司乃註冊電業承辦商)

DCL Communication Ltd • Full Time • Hong Kong, Hong Kong • HK$ 15,000 - HK$ 25,000 / month • 1d ago

Engineering Full Time

負責調試, 保養及維修電腦房空調冷氣機組; 處理有關空調機組之緊急維修; 需要於正常工作時間以外提供突發緊急維修服務處理空調設備之維修保養及調試事宜經驗,具電腦房空調經驗/持有電業工程人員證書/電工A牌優先每月$15,000 - $25,000(...

1d ago

Apply

Senior DevOps Engineer

Lane Crawford • Full Time • Southern District, HK • 1d ago

Engineering Full Time

Lane Crawford is an internationally renowned luxury department store with over 175 years of success, delivering an exceptional and eclectic product curation with dynamic Asian spirit and values. As our Senior DevOps Engi...

1d ago

Apply

(Senior) DevOps Engineer

Omnichat • Full Time • Hong Kong, HK • 1d ago

Engineering Full Time

Company Highlights Omnichat is the Business Partner and WhatsApp Business Solution Provider of META. Founded in 2017, Omnichat specializes in centralizing customers’ conversations from WhatsApp Business Platform, Faceboo...

1d ago

Apply

Staff / Principal Software Engineer (Rust/C++/C)

ExpressVPN • Full Time • Hong Kong, HK • 1d ago

Engineering Full Time

Our Core VPN Team is hiring a Staff / Principal Software Engineer (Rust/C++/C) Location: Hong Kong, Hybrid working model About the Role: You’ll enhance and maintain Lightway, the VPN protocol that keeps millions of peopl...

1d ago

Apply