As an Application Security Engineering Manager, you will be the core leader of the company’s application security team, responsible for formulating and implementing the company’s application security strategy and technical roadmap. You will lead the team to build a full-lifecycle application security system covering requirements, design, development, testing, deployment, and operation, focusing on identifying and mitigating security risks of core business systems in digital currency trading and payment scenarios. This role requires in-depth understanding of application security technologies, rich team management experience, and familiarity with global regulatory requirements for digital assets and payment security, to ensure the security, stability, and compliance of the company’s application systems.
Key Responsibilities
1. Application Security Strategy & System Construction
Formulate the company’s long-term and short-term application security strategy, technical roadmap, and implementation plan, combining the company’s business development goals, risk control requirements, and regulatory compliance needs.
Lead the construction, optimization, and iteration of the application security system, including security development lifecycle (SDLC) management, vulnerability management, security code review, penetration testing, and security monitoring, to ensure the system’s comprehensiveness and effectiveness.
Establish and improve application security standards, specifications, and operation processes, including security coding standards, security test standards, and vulnerability handling processes, to standardize the application security work of the entire company.
Track the latest application security technologies, vulnerabilities, and attack methods, introduce advanced security tools and technical solutions, and continuously improve the company’s application security defense capabilities.
2. Team Management & Development
Build, manage, and develop the application security engineering team, formulate team OKRs, performance assessment standards, and talent training plans to improve the team’s professional capabilities (security code review, penetration testing, vulnerability research, etc.).
Arrange daily work assignments for the team, supervise work progress, solve technical difficulties in application security, and create a positive and collaborative team atmosphere.
Guide team members’ professional growth, organize technical training, security skill exchanges, and vulnerability emergency response drills, and cultivate a professional application security talent echelon.
Manage team performance, conduct regular performance reviews, and motivate team members to achieve work goals and improve work quality.
3. Application Security Risk Management & Control
Lead the team to conduct application security risk assessments for core business systems (digital currency trading platform, payment system, user authentication system, etc.), identify potential security risks and vulnerabilities, and formulate targeted risk mitigation plans.
Promote the integration of security into the entire SDLC, conduct security reviews in the requirements and design phases, perform security code reviews and penetration testing in the development and testing phases, and implement security verification in the deployment phase.
Establish and manage the vulnerability management system, track the discovery, classification, remediation, and verification of vulnerabilities, ensure that high-risk vulnerabilities are handled in a timely manner, and reduce security risks.
Respond to application security incidents (such as code vulnerabilities, data leakage, and attack incidents), organize the team to conduct emergency disposal, investigate the root cause, and formulate prevention measures to avoid recurrence.
4. Compliance & Regulatory Support
Ensure that application security work complies with global regulatory requirements (FATF, MiCA, local regulations) and industry standards (such as ISO 27001, PCI DSS), and meets the security and compliance requirements of digital currency and payment businesses.
Cooperate with the compliance team to complete application security-related compliance audits, risk assessments, and regulatory reporting, and provide relevant technical materials and explanations.
Participate in the formulation and improvement of the company’s information security compliance system, and promote the implementation of application security compliance requirements in all business links.
5. Cross-departmental Collaboration & Security Promotion
Communicate closely with R&D, product, testing, operation, and compliance departments to promote the integration of application security into business processes and ensure that security requirements are implemented in each link.
Provide application security technical support and guidance for R&D teams, including security coding training, vulnerability remediation guidance, and security solution consultation.
Promote enterprise-wide application security awareness training, improve the security awareness of employees in all departments, and reduce security risks caused by human factors.
Cooperate with the network security, data security, and other teams to build a comprehensive information security defense system and ensure the overall security of the company’s business.
