Principal Security Operation Engineer (Red Team)

<div class="content-intro"><p><strong>About Us</strong></p> <div data-page-id="HladdPLXIoNz4nxkqkCuk4rAs8v" data-lark-html-role="root" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-XCikdRR2xoZIjdxtCKcuOflrs8d">Established in 2018, Bybit is one of the world’s leading cryptocurrency exchanges and digital financial platforms, serving over 80 million users across more than 200 countries and regions. Powered by world-class technology and a user-first mindset, Bybit delivers a seamless ecosystem across trading, payments, wealth management, custody, institutional services, and Web3 — connecting users to the future of digital finance.</div> <div class="ace-line ace-line old-record-id-IF06dI0MPoBwYfxbZ4zui13HsoC">&nbsp;</div> <div class="ace-line ace-line old-record-id-X5EbdOwvMoYuOmxQBbuueUEDsDd">Our core values define how we build. We listen, care and improve to create products and experiences that put users first. Backed by a global team of ambitious builders, problem-solvers, and innovators, we foster a high-performance and fast-moving environment where talent is empowered to drive real impact at the global scale. Supported by 24/7 multilingual customer service and a strong commitment to innovation, we are shaping the future of finance through technology, collaboration, and bold execution.</div> <div class="ace-line ace-line old-record-id-LtVud2dO7oglqJxxZoOucqjJsPc">&nbsp;</div> <div class="ace-line ace-line old-record-id-RMHkdm4bPo66l3xMVO8ui1o8sle">Today, Bybit is recognized as one of the most trusted and transparent platforms in the digital asset industry, continuing to expand its global presence while building the infrastructure for the next generation of financial services.</div> </div></div><div data-lark-html-role="root"> <div class="rich-text-paragraph" data-eleid="7"><strong><span class="text-only" data-eleid="translation-8"><span class="text-only">Job responsibilities</span></span></strong></div> <div class="rich-text-paragraph" data-eleid="7">&nbsp;</div> <div class="rich-text-paragraph" data-eleid="9"><strong><span class="text-only" data-eleid="translation-10"><span class="text-only">Red-blue confrontation drill</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="11"> <li class="richTextDocs-listItem" data-eleid="12"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-13"><span class="text-only">Responsible for developing and executing penetration testing, red-blue confrontation, and practical attack and defense drills that simulate real attack scenarios, identifying potential security risks in enterprise networks, applications, cloud environments, work networks, and core business systems.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="14"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-15"><span class="text-only">Lead or participate in red-blue confrontation exercises to evaluate the defense team's ability in attack detection, alarm analysis, traceability analysis, emergency response, and recovery.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="16"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-17"><span class="text-only">Based on the real attack chain design exercise scenario, covering extranet breakthrough, web vulnerability exploitation, phishing entrance, privilege escalation, lateral movement, Data Discovery, privilege maintenance, and defense bypass stages.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="18"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-19"><span class="text-only">Combining the attack review results, promote the continuous optimization of security detection rules, response processes, asset governance, and security base lines.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="20"><strong><span class="text-only" data-eleid="translation-21"><span class="text-only">Attack Surface Analysis and Threat Research</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="22"> <li class="richTextDocs-listItem" data-eleid="23"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-24"><span class="text-only">Identify enterprise network exposure, internet assets, cloud assets, APIs, supply chain components, and third-party access risks, evaluate attack paths, and provide mitigation recommendations.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="25"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-26"><span class="text-only">Monitor and collect threat intelligence, track vulnerability exploitation trends, APT attack methods, red team toolchain changes, and apply them to enterprise attack and defense exercises.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="27"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-28"><span class="text-only">Combining business scenarios to model attack paths and discover feasible attack chains from external exposure surfaces to core assets.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="29"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-30"><span class="text-only">Tracking AI-related security risks, including security issues in large-scale model applications, RAG systems, Agent systems, plug-in/tool calls, MCP services, AI code generation, and automated workflows.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="31"><strong><span class="text-only" data-eleid="translation-32"><span class="text-only">AI Security and Large Model Attack and Defense</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="33"> <li class="richTextDocs-listItem" data-eleid="34"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-35"><span class="text-only">Responsible for the security evaluation of AI applications, intelligent agent systems, RAG Knowledge Base, AI Agent toolchain and model services within the enterprise.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="36"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-37"><span class="text-only">Research and verify large-scale model-related attack techniques, including Prompt Injection, Jailbreak, Indirect Prompt Injection, data leakage, unauthorized tool invocation, security risks caused by model illusions, RAG poisoning, vector library pollution, sensitive information leakage, etc.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="38"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-39"><span class="text-only">Design AI red team test cases and evaluation framework, and conduct security verification on model input and output, context isolation, permission control, tool call chain, and data access boundary.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="40"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-41"><span class="text-only">Participate in the construction of AI security protection plan, including prompt word security policy, content security detection, tool call permission constraints, sensitive data desensitization, audit tracking, Agent sandbox isolation and security evaluation benchmark construction.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="42"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-43"><span class="text-only">Explore the application of AI in red team automation, vulnerability analysis, attack path planning, PoC verification, and report generation, and promote the platformization, automation, and intelligence of attack and defense capabilities.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="44"><strong><span class="text-only" data-eleid="translation-45"><span class="text-only">Tool and platform development</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="46"> <li class="richTextDocs-listItem" data-eleid="47"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-48"><span class="text-only">Develop and optimize Red Team-specific tools and scripts for vulnerability mining, information collection, privilege escalation, lateral movement, credential analysis, traffic disguise, defense bypass, and automated report generation.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="49"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-50"><span class="text-only">Study and validate new attack techniques, and simulate real threats in combination with enterprise business scenarios.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="51"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-52"><span class="text-only">Build or participate in the construction of automated security evaluation platform, integrated vulnerability scanning, audio fingerprint recognition, asset mapping, PoC verification, attack path analysis, AI Agent arrangement and other capabilities.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="53"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-54"><span class="text-only">Combining LLM/Agent technology to explore automated penetration testing, intelligent vulnerability verification, code security auditing, and red team task scheduling.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="55"><strong><span class="text-only" data-eleid="translation-56"><span class="text-only">Security evaluation and reporting</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="57"> <li class="richTextDocs-listItem" data-eleid="58"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-59"><span class="text-only">Conduct security evaluations on critical business systems, internal networks, cloud environments, work end points, API services, and AI applications, and output detailed technical reports, attack paths, impact analysis, and repair recommendations.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="60"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-61"><span class="text-only">Output AI security evaluation reports for AI applications, including attack examples, risk levels, exploitable paths, data leakage risks, permission boundary issues, and governance recommendations.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="62"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-63"><span class="text-only">Assist in improving enterprise security protection mechanisms, promote optimization of WAF, EDR, SIEM, NDR, HIDS, zero trust, identity permissions, and log auditing capabilities.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="64"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-65"><span class="text-only">Transform attack and defense discovery into security detection rules, base line specifications, develop security requirements, and continuous governance mechanisms.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="66"><strong><span class="text-only" data-eleid="translation-67"><span class="text-only">XFN collaboration</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="68"> <li class="richTextDocs-listItem" data-eleid="69"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-70"><span class="text-only">Collaborate with the blue team, security operation, infrastructure, R &amp; D, algorithm, data, and business teams to complete attack review, vulnerability repair, detection rule optimization, and security capability building.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="71"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-72"><span class="text-only">Provide security support to other departments of the enterprise, including emergency response drills, development security consulting, AI application pre-launch security review, and security training.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="73"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-74"><span class="text-only">Participate in the security design review of AI applications and security products, and promote the advance of security capabilities in R &amp; D, testing, and Pushonline.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="75">&nbsp;</div> <div class="rich-text-paragraph" data-eleid="75"><strong><span class="text-only" data-eleid="translation-76"><span class="text-only">Job requirements</span></span></strong></div> <div class="rich-text-paragraph" data-eleid="75">&nbsp;</div> <div class="rich-text-paragraph" data-eleid="77"><strong><span class="text-only" data-eleid="translation-78"><span class="text-only">Basic skills</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="79"> <li class="richTextDocs-listItem" data-eleid="80"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-81"><span class="text-only">Proficient in basic knowledge of cyber security, including TCP/IP protocol, network architecture, identity authentication, access control, principles and configurations of common security devices.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="82"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-83"><span class="text-only">Proficient in common attack techniques and red team toolchains, such as Sliver, Cobalt Strike, NPS, Burp Suite, Metasploit, Nmap, Masscan, Frida, Impacket, etc.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="84"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-85"><span class="text-only">Familiar with mainstream operating systems Windows, Linux, macOS security mechanism, log system, permission model and common use.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="86"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-87"><span class="text-only">Familiar with common web frameworks, API architectures, microservice structures, containers, and security risks in Kubernetes environments.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="88"><strong><span class="text-only" data-eleid="translation-89"><span class="text-only">Offensive and defensive technical capabilities</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="90"> <li class="richTextDocs-listItem" data-eleid="91"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-92"><span class="text-only">Proficient in penetration testing and red team processes, including information collection, vulnerability scanning, vulnerability exploitation, intranet penetration, privilege escalation, lateral movement, privilege maintenance, Data Discovery, and trace cleaning.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="93"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-94"><span class="text-only">Familiar with the working principles and adversarial methods of enterprise-level security products, including WAF, EDR, SIEM, NDR, HIDS, zero-trust gateway, bastion host, and identity authentication system.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="95"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-96"><span class="text-only">Possess independent vulnerability analysis and PoC writing capabilities, able to reproduce, verify, and assess the impact of public vulnerabilities and 0day/1day risks.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="97"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-98"><span class="text-only">Proficient in one or more programming/scripting languages, such as Python, Go, Bash, PowerShell, JavaScript, etc., with experience in tool development and automation platform construction.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="99"><strong><span class="text-only" data-eleid="translation-100"><span class="text-only">AI security capabilities</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="101"> <li class="richTextDocs-listItem" data-eleid="102"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-103"><span class="text-only">Familiar with the basic architecture of large-scale model applications, familiar with technical forms such as Prompt, RAG, Embedding, vector databases, Agent, Function Calling, MCP, and plugin systems.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="104"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-105"><span class="text-only">Understand or practice AI security testing methods, including Prompt Injection, Jailbreak, RAG data poisoning, sensitive information leakage, unauthorized tool invocation, model output security, Agent permission escape, etc.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="106"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-107"><span class="text-only">Able to design security test cases for AI applications, evaluate model input/output, context isolation, data boundaries, permission control, and tool invocation chain risks.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="108"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-109"><span class="text-only">Experience in using AI to assist security work, including vulnerability analysis, code auditing, intelligence analysis, attack path planning, report generation, or automated testing.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="110"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-111"><span class="text-only">Familiar with AI application security governance ideas, including model call auditing, prompt word security, sensitive data protection, content security detection, permission minimization, and sandbox isolation.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="112"><strong><span class="text-only" data-eleid="translation-113"><span class="text-only">Experience requirements</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="114"> <li class="richTextDocs-listItem" data-eleid="115"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-116"><span class="text-only">More than 5 years of experience in red team, penetration testing, security research, or offensive and defensive exercises.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="117"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-118"><span class="text-only">Candidates with experience in large-scale enterprise attack and defense drills, red-blue confrontation, HW/major support, cloud attack and defense, or intranet penetration are preferred.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="119"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-120"><span class="text-only">Candidates with experience in AI security, large-scale model security, intelligent agent security, automated penetration testing platform or security tool platform construction are preferred.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="121"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-122"><span class="text-only">Familiar with enterprise security construction system, able to promote defense capability, detection capability, and governance process optimization from an attack perspective.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="123"><strong><span class="text-only" data-eleid="translation-124"><span class="text-only">Other capabilities</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="125"> <li class="richTextDocs-listItem" data-eleid="126"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-127"><span class="text-only">Priority will be given to those who hold security-related certifications such as ♀ P, OSCE, CISSP, CISP, CEH, CISSP, CCSP, etc.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="128"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-129"><span class="text-only">Possess strong document writing and expression abilities, able to output high-quality technical reports, review documents, attack chain analysis, and security construction plans.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="130"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-131"><span class="text-only">Possess good problem analysis ability, learning ability, teamwork ability, and stress resistance.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="132"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-133"><span class="text-only">Be sensitive to new technologies, new Attack Surfaces, and new tools, and be able to proactively research and share internally.</span></span></div> </li> </ul> <div class="rich-text-paragraph" data-eleid="134"><strong><span class="text-only" data-eleid="translation-135"><span class="text-only">Bonus points</span></span></strong></div> <ul class="richTextDocs-unOrderList richTextDocs-unOrderList-disc" data-eleid="136"> <li class="richTextDocs-listItem" data-eleid="137"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-138"><span class="text-only">Familiar with Cloud Computing Platform security and cloud attack and defense technologies, such as AWS, Azure, GCP, Tencent Cloud, Alibaba Cloud, etc.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="139"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-140"><span class="text-only">Familiar with Kubernetes, containers, Service Mesh, CI/CD, DevSecOps and supply chain security.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="141"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-142"><span class="text-only">Possess experience in zero trust, secure operation, threat hunting, Attack Surface management, and vulnerability management platform construction.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="143"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-144"><span class="text-only">Familiar with MCP Server, AI Agent framework, RAG system, vector database, LLM API gateway, model security evaluation framework.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="145"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-146"><span class="text-only">Experience in Automated Red Team, AI Penetration Testing, Intelligent Vulnerability Verification, Agent Orchestration, Security Knowledge Base or Security RAG System Construction.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="147"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-148"><span class="text-only">Experience in vulnerability submission, CVE, technical articles, open source projects, topic sharing, or tool release in the security community.</span></span></div> </li> <li class="richTextDocs-listItem" data-eleid="149"> <div class="richTextDocs-listItem__text"><span class="text-only" data-eleid="translation-150"><span class="text-only">Familiar with security frameworks such as MITRE ATT &amp; CK, OWASP Top 10, OWASP LLM Top 10, NIST AI RMF, etc.</span></span></div> </li> </ul> </div><div class="content-conclusion"><p><strong>Why Join Us</strong><br>At Bybit, we are committed to fostering a supportive and enriching work environment.&nbsp;<br>Our benefits include:<br>- Study Growth Fund: We support your professional development and continuous learning.<br>- Internal Events: Participate in regular team-building activities, workshops, and events designed to promote collaboration and innovation.<br>- Global Collaboration: Be part of a diverse, international team, working alongside colleagues from around the world.<br>- Career Advancement: Access opportunities for growth and advancement within a rapidly expanding global company.<br>- Internal Mobility: Grow with us- Your long-term development is important to us. We offer internal job opportunities to help build your career path.</p></div>