Class of 2028 / New graduate Security Engineer - Mercari Group

Class of 2028 / New graduate Security Engineer - Mercari Group

• Target Applicants: Those who can join as new graduates in October 2027 or April 2028.
• As a general rule, candidates are expected to participate in an internship before applying for the full-time position. If you are unable to participate due to personal circumstances, please apply through this job posting. If you are able to participate in an internship, please apply through the internship job posting.
• Employment Status: Permanent (New Graduate)
• Office: in Japan (Roppongi)
• Application Deadline: December 31, 2026, 23:59 (JST)
• For more details, see the Overview of Our Positions section on our Careers site.
  　　

About Mercari

Circulate all forms of value to unleash the potential in all people

"What can I do to help society thrive with the finite resources we have?" The Mercari marketplace app was born in 2013 out of this thought by our founder Shintaro Yamada as he traveled the world. We believe that by circulating all forms of value, not just physical things and money, we can create opportunities for anyone to realize their dreams and contribute to society and the people around them. Mercari aims to use technology to connect people all over the world and create a world where anyone can unleash their potential. For more information about Mercari Group’s mission, see Mercari’s Culture Doc.

Organization/Team Mission

This role provides an environment where you can engage in experience design with a management perspective, not just engineering tasks, and grow into a leader who will drive the Mercari Group in the future. For those aiming to become future product leaders, this role offers the opportunity to take on challenges from both business growth and social problem-solving perspectives.

Mercari Engineering Principles

Mercari Engineering Principles are a shared understanding that serves as the foundation of engineering beliefs and behavior at Mercari. The Engineering Principles are designed to complement the organizational identity (Mercari’s mission, values, and culture) from an engineering viewpoint.

These principles ultimately help us achieve Mercari’s mission by defining the ideal state we seek to realize in the long term.

• Passion For The Product
• Grow Together
• Solve Through Mechanisms
• Collaborate Openly

For more details, please see the following link:

• Engineering Culture

As a member of the Mercari Security Engineering Team, you will review security designs and processes, develop and deploy security countermeasures, and conduct penetration tests. This is a unique role within Mercari because security engineers are involved in projects that impact the entire organization.

Examples of responsibilities include:

• Monitoring, log analysis, and development of logging infrastructure
• Performing security reviews and creating threat models
• Designing and implementing security automation or dashboards
• Web and mobile application security testing
• Technical project management

See here for more information about our mission and values.

Work Responsibilities

• Participate in threat modeling, code reviews, and security testing under the guidance of senior engineers to help identify and reduce risk in Mercari’s systems.
• Develop or enhance automation scripts for common security tasks such as compliance checks, asset inventory reconciliation, and alerting.
• Conduct focused security research on a supervised topic (e.g., AI system security, supply chain risks), summarize key findings, and propose actionable improvements for Mercari.
• Support vulnerability management processes by helping triage security findings, verify issues, and coordinate with developers on remediation efforts.
• Contribute to internal documentation, including secure development guidelines, AI security best practices, security playbooks, and onboarding material for engineers.
• Assist in security monitoring efforts, such as analyzing logs to detect anomalies, tuning detection rules, and helping track misconfigurations or policy violations.

About Our Teams

• Threat Detection and Response Team
• This team develops and operates Mercari Group’s security monitoring, detection engineering, and incident response capabilities. Our work spans security logging, detection-as-code, SOAR automation, AI-assisted workflows, and hands-on investigations to support fast and scalable threat monitoring across the Group.
• Platform Security Team
• This team develops and operates the security controls and guardrails that protect Mercari's global engineering platform, covering access management (GitHub, GCP, PAM), CI/CD and infrastructure-as-code security, supply chain risk management, and Kubernetes security. By partnering closely with Enterprise Security, Product Security, AI Security, and Infrastructure teams, the team embeds security into the software development lifecycle so engineers across the Group can build and deploy safely at scale.
• Product Security Team
• This team is responsible for ensuring that all customer-facing and internal-facing applications are built securely throughout the entire development lifecycle, preventing vulnerabilities before products reach production. This is achieved by conducting threat modeling, security architecture reviews, automated scanning, and penetration testing, while working directly alongside engineering teams to remediate flaws. Additionally, the team establishes secure coding standards, manages vulnerability disclosure programs, and builds automated security guardrails so developers can ship features quickly without compromising safety.
• Enterprise Security Team
• This team develops and operates scalable security controls and guardrails to protect Mercari’s global workforce platform across identity, endpoints, core SaaS, and corporate networks. By embedding Zero Trust and defense-in-depth principles, the team minimizes security risks while delivering a secure-by-default experience that boosts productivity and enables fearless innovation across the Group.

Why Mercari is a Great Place to Learn Security Engineering

• Cutting-Edge Infrastructure: Our platform is built on modern, cloud-native technologies (GCP, Kubernetes, Terraform, etc.) and integrates with advanced AI and automation tools across the stack.
• Real-World Impact at Scale: You’ll work with data and systems that support tens of millions of users. That means tackling complex security and infrastructure problems you won’t encounter in smaller environments.
• A Culture of Innovation: We’re experimenting with AI-driven development, zero trust architecture, and secure-by-design initiatives—and team members are encouraged to contribute, ask questions, and grow.

• Mentorship & Collaboration: You’ll be guided by experienced security engineers who are passionate about sharing knowledge and building the next generation of talent.

Unique Challenges

• The Security Engineering and Strategy team at Mercari is responsible for dealing with a vast array of data, logs, and dependencies. As a member of the team, you will be able to employ cutting-edge and complex cloud infrastructure systems to help us tackle new and unexplored challenges.
• With a rapidly growing number of organizations and services, it is extremely important for Mercari to introduce automation and reduce dependency on manual work as much as possible. This is an exciting opportunity to gain experience in helping us build out our security systems and solve interesting challenges in a fast-paced environment.

Qualifications

• Required Experience/Skills
• Shared understanding and belief in our company’s mission and values
• Strong interest in cybersecurity and engineering
• Programming experience with one or more programming languages including but not limited to: Go, Python, PHP, JavaScript
• Enrolled in a Bachelor's degree (or higher) program or technical school in Computer Science, Information Security, or other engineering-focused major
• Effective interpersonal and communication skills
• Basic familiarity with Linux, including common commands and scripting
• Foundational knowledge of SQL and data querying
  
• Preferred Experience/Skills
• Basic understanding or strong interest in any of the following:
• Experience attending or speaking at domestic and international security conferences, such as SECCON, Hardening Project, Black Hat, or DEF CON.
• Hands-on experience in security practices such as participating in CTF (Capture The Flag) competitions, bug bounty programs, or penetration testing.
• Knowledge of Web or mobile application security testing.
• Public cloud infrastructure platforms (GCP, AWS or Azure)
• Container and orchestration technologies (Docker, Kubernetes)
• Security automation and DevSecOps
• Experience leveraging AI for security operations automation and the protection of AI-driven systems
• Basic experience with software development tools such as Git, dependency management, build and deployment tools
• Understanding of modern Web or mobile applications
  
• Language
• English or Japanese: Independent (CEFR-B2)
  The Security Team is a globally diverse group, with members from many different countries and a wide range of Japanese and English proficiency levels. We value mutual respect, effort, and empathy, and we actively work to bridge language gaps so that every team member feels welcomed and understood—regardless of their native language. Our goal is to create a supportive and inclusive environment where everyone can thrive and collaborate effectively.

For details about CEFR, see here.
　

Learn More About Mercari Group

• Careers site:
• Mercan:
• Social media: X / Linkedin

Recruiting at Mercari

At Mercari Group, we value empathizing with and embodying the mission and values ​​of the Group and each company. To promote the creation of an organization that maximizes the total amount of value exhibited by all members, we would like to understand the experience and skills of each candidate as accurately as possible.

Hiring Process at Mercari Group

• Application screening
• Skill assessment: Completed via HackerRank
• Interview: Three rounds
• Offer: Determined based on the final interview

　Learn more about our recruiting process here.

Equal Opportunity Hiring

Here at Mercari, we work to realize a world in which no one’s potential is limited by their background and everyone has the opportunity to freely create value. We also firmly believe that a mindset of Inclusion & Diversity is essential for us to achieve our mission.

This, of course, extends to our hiring practices as well. Mercari is committed to eliminating discrimination based on age, gender, sexual orientation, race, religion, physical disability, and other such factors so that anyone who shares our mission and values can join us, regardless of their background. For more details, please read our I&D statement.

Please read and acknowledge our Privacy Policy prior to submitting your application.