Cybersecurity Engineer Intern (Web Security) - Information Security (Spring 2027)

Department Engineering and Technology LevelInternship LocationSingapore The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do. About the Team: The Engineering and Technology team is at the core of the Shopee platform development. The team is made up of a group of passionate engineers from all over the world, striving to build the best systems with the most suitable technologies. Our engineers do not merely solve problems at hand; We build foundations for a long-lasting future. We don't limit ourselves on what we can or can't do; we take matters into our own hands even if it means drilling down to the bottom layer of the computing platform. Shopee's hyper-growing business scale has transformed most "innocent" problems into huge technical challenges, and there is no better place to experience it first-hand if you love technologies as much as we do. Job Description: * Perform security assessments and penetration testing on Shopee's web applications, APIs and internal systems; find real, exploitable issues and drive them to closure with engineering teams. * Review code and architecture designs to catch security flaws before they ship, and help embed security requirements into new business and technology initiatives. * Build and improve the security automation and tooling that scales the team's coverage beyond manual review: in-house AI agents for security workflows, as well as SAST, DAST and SCA capabilities integrated into the development pipeline. * Assess the security of AI-powered features and internal AI tooling — prompt injection, unsafe tool/agent invocation, data leakage and over-permissive integrations. * Support vulnerability response and incident investigation; track industry trends and bring what you learn back into our defences. Requirements: * Currently pursuing Bachelor's degree or above in Computer Science, Information Security, Cyberspace Security or a related field preferred. * Solid networking and web fundamentals: a working understanding of L4/L7 protocols, HTTP, TLS, session and authentication mechanisms, and the risks introduced by common cryptographic misuse. * Familiar with the OWASP Top 10 — able to explain the root cause, exploitation path and correct remediation of each class; understands the mechanics and exploit chains of landmark vulnerabilities such as fastjson and log4j. * Proficient in at least one of Go, Java, Python, PHP, C or JavaScript; able to read design documents and business code, and to script your way out of repetitive work. * Basic grasp of business-logic vulnerabilities: broken access control, authentication bypass, race conditions and flawed workflows. * Aware of the security risks in AI / LLM applications (e.g. the OWASP Top 10 for LLM Applications), with genuine curiosity about how AI is reshaping both the attack surface and the defender's toolkit. * A fast learner who communicates clearly — able to explain a vulnerability to engineers without a security background. * Full-time interns preferred (3-6 months). Part-time interns who can commit at least 3 working days a week are also welcome to apply. **Preferred Qualifications:** * Interested in security engineering: understands the basic principles and limitations of SAST / DAST / SCA, and prefers building tools over repeating manual work. * CVEs credited in well-known open-source projects or general-purpose software, especially framework-level findings. * Placements in CTF competitions, or a consistent track record on SRC / bug bounty platforms. * Has built security tooling: scanners, fuzzers, SAST rules (Semgrep / CodeQL), Burp extensions, or LLM-based security automation and agents. * A security blog, GitHub projects, conference talks or published research.