Senior Security Operations Engineer (SecOps)
Company Introduction:
At SNSoft, we're at the forefront of technological advancement, integrating cutting-edge solutions into everyday life. Our culture thrives on innovation, collaboration, and a commitment to excellence. We foster an inclusive environment where every team member's contribution is valued and where everyone has the opportunity to grow.
Benefits and Compensation:
Competitive salary range depending on experience.
Project Incentive (upon Company Declaration based on project performance)
Transport, Meal, Birthday Allowances (upon Confirmation)
Sports Activities (Badminton & Basketball), Company Outing
Training and certification sponsored by company (Selected employees).
Optical, Dental, Body Check Up Claim (upon Confirmation)
Job Summary:
Own security monitoring, threat detection, and incident response across our multi-cloud environment, and drive automation of detection and response.
Key Responsibilities
Conduct proactive offensive security testing and attack validation across public-facing Web, API, mobile, cloud and infrastructure environments. Identify realistic and exploitable attack paths and drive remediation to closure.
Perform penetration testing, vulnerability validation and red/blue security exercises, going beyond automated vulnerability scanning to understand how weaknesses can be exploited in real-world scenarios.
Run security monitoring, alert triage, investigation and severity classification (P0–P3) using our SIEM environment (Alibaba Cloud Threat Analysis / Agentic SOC + SLS).
Develop and tune detection rules to improve coverage of key threats such as account takeover, automated attacks, credential or secret leakage, privilege misuse, ransomware and business-logic abuse, while continuously reducing false positives.
Translate identified attack techniques and vulnerabilities into practical detection, prevention and response controls.
Lead end-to-end Incident Response, including detection → investigation → containment → eradication → recovery → post-mortem, with clear written incident reports.
Develop SOAR and security automation playbooks, preferably using Go, to automate repetitive response activities such as auto-blocking, isolation, credential handling and security enrichment.
Aggregate security logs across multiple platforms (Alibaba Cloud primary + AWS + Tencent Cloud + Cloudflare) into the SIEM for unified monitoring and analysis.
Operate and optimize native cloud and platform security capabilities such as Cloud Security Center, GuardDuty, WAF and other security controls.
Conduct security reviews of new systems, features and APIs before production release, working closely with Engineering and Product teams to identify potential attack vectors and security risks early.
Participate in the on-call rotation to ensure timely investigation and response to critical security alerts and incidents.
Required Qualifications
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering or a related field, or equivalent practical experience.
3+ years of hands-on cybersecurity experience, including Security Operations, Incident Response, Product/Application Security or Offensive Security.
Hands-on Offensive Security experience is required, including practical experience in penetration testing, attack simulation or vulnerability exploitation.
Able to independently perform security testing against Web applications and APIs, identify realistic attack paths and validate vulnerabilities beyond automated scanner results.
Ability to develop PoCs, scripts or exploit scenarios to demonstrate and validate security weaknesses.
Strong understanding of common Web and API attack techniques, authentication and authorization weaknesses, business-logic vulnerabilities and attacker methodologies.
Hands-on experience with SIEM and log analytics platforms such as SLS, Splunk, ELK or equivalent, including developing and tuning detection rules.
Practical experience in security investigation and incident response, with the ability to independently investigate and respond to security incidents.
Strong security fundamentals across network, operating systems, Web applications, APIs and cloud environments.
Development or scripting capability for security automation; Go is preferred, while Python or other scripting languages are also welcome.
Familiarity with the security stack of at least one major public cloud platform such as Alibaba Cloud, AWS or Tencent Cloud.
Able to think from an attacker's perspective, understand how vulnerabilities can be chained into realistic attack paths, and translate those findings into effective defensive controls.
Detail-oriented, accountable and comfortable participating in an on-call rotation.
Nice to Have
Red Team / Purple Team experience in a production or professional security environment.
Bug bounty, VDP, CTF, CVE or other demonstrable offensive security achievements.
Threat Hunting and MITRE ATT&CK mapping experience.
Experience building or operating SOAR workflows and security automation.
Security experience supporting high-traffic, public-facing consumer platforms, payments, e-commerce, social platforms or other transaction-intensive environments.
Experience investigating account abuse, automated attacks, bot activity, transaction abuse or business-logic attacks.
Experience with risk engines, device fingerprinting, behavioural analysis or bot detection.
Hands-on experience with DDoS and application-layer attack mitigation.
Multi-cloud security operations experience across Alibaba Cloud, AWS, Tencent Cloud and Cloudflare.
Experience working closely with Engineering and Product teams on security assessment, remediation and secure-by-design initiatives.