Security Engineer

About Mercari

We believe the world needs a place where people can exchange their loved goods. That’s why we built Mercari—to connect people who want to buy and sell things of emotional value through their mobile phones. Mercari has grown to become a leading community-powered marketplace that brings together millions of people every day.

Mercari Dev Meetups

Position

Remote work is also possible.

Mercari’s culture has been central to the company since our founding, with the three core values of Go Bold, All for One, and Be a Pro. In addition, the “Trust & Openness” value was introduced to embody our culture of mutual trust, where information remains transparent and rules are kept to a minimum. Regardless of how big Mercari gets, our culture is essential to achieving our mission and will be promoted throughout our organization.

Work Responsibilities

• As a Security Engineer in the Mercari Security Engineering Team, you will perform security design and process reviews as well as develop and deploy security countermeasures, and execute penetration tests. This is a unique role within Mercari since you will be involved in high-stakes projects across the organization. In addition, you will help us ensure the integration of and compliance with security best practices, frameworks, and regulations in these projects 
• Mercari follows the philosophy of “security as code”, so our security engineers are expected to automate and optimize the solutions they develop. That’s why we are looking for people passionate about automation to join our team! Specifically, you will:
  • Review system designs to define necessary security requirements based on threat evaluation and attack trees
  • Review architecture proposals, such as infrastructure or information flows, and propose security controls to minimize risks
  • Conduct vulnerability assessments and penetration testing on Mercari’s production and corporate infrastructure
  • Automate security controls and monitoring 
  • Develop technical solutions to help mitigate security vulnerabilities 
  • Maintain technical & security standards for production and corporate infrastructure services
  • Educate engineering teams on security practices with hands on workshops, tech talks, and lectures 
  • Participate in the incident response process, identify remediation actions and deploy countermeasures 
  • Collaborate with information security officers, the legal team, and internal auditors on technical security matters

Bold Challenges

• Security Engineers at Mercari are responsible for dealing with a vast array of data, logs, and dependencies. You will be able to use cutting-edge and complex cloud infrastructure systems to help us tackle unknown issues
• With rapidly growing organizations and services, it is extremely important for Mercari to introduce automation and stop depending on manual work as much as possible. This is an exciting opportunity to gain experience helping us build our security systems and solve issues in a fast-paced environment

Your qualification

• 4+ years of experience in security domains
• Programming experience with one or more programming languages including but not limited to: Go, Python, PHP, Javascript
• Public cloud infrastructure platforms (GCP, AWS and Azure), as well as container technologies (Docker, Kubernetes)
• Penetration testing, web application security testing, vulnerability scanning, threat-based infrastructure risk assessment
• Security automation and DevSecOps methodologies
• Corporate security solutions (DLP, IAM, MDM, Endpoint security/EDR, CASB, ZeroTrust, MFA)
• Implemented security controls based on security frameworks and regulations (ISO27001, PCI-DSS, CCPA)
• Key management and applied cryptography (TLS, PKI, KMS, blockchain, data encryption)

Will be a plus

• Bachelor's degree in Computer Science or equivalent practical experience
• Good understanding of modern web application architecture
• Recognized security certifications (CISSP, OSCP, GIAC)
• Experience leading or investigating in incident handling cases, performed computer forensic investigations, or malware analysis
• Experience with software development tools, such as version control systems, integrated development environments (IDE), and CI/CD tools
• SQL Querying (BigQuery, Mysql)
• Effective interpersonal and communication skills

Screening Criteria

• Foundation in, and in-depth technical knowledge of, security engineering, computer and network security, operating system security, authentication, security protocols and applied cryptography
• Understanding of HTTP, TCP/IP, and standard network and system security technologies fundamentals
• Coding experience in Go, PHP, JavaScript or Python; experience with mobile security is a plus (iOS and Android applications)
• Programming, Domain Driven Design, and Test Driven Design
• Self-motivated and results-oriented
• Good understanding of microservices architecture
• Knowledge of container and orchestration technology like Docker and Kubernetes
• Experience working on cloud infrastructures like GCP or AWS
• Experience working in a DevOps/Agile environment
• Enjoy programming and automation
• Enjoy working across engineering teams to help define architecture requirements and deliver projects securely
• Strong teamwork skills in a diverse environment

Technical Assessment Criteria

• Technical test
• Technical interview
• Follow-up exercises
• Interview
• Final interview

*See this page for details

Language Requirements

• English or Japanese: Independent (CEFR-B2)
  *For details about CEFR, see here
  • The Security Team is a diverse team with members from around the globe. Team members have various levels of Japanese and English proficiency and we value mutual effort, understanding, and support, and we aim to meet in the middle to make everyone feel comfortable regardless of the member’s native language

What we offer

Employment Status

Full-time

• Probationary period: First 3 months after joining the company (During this period your contract conditions will be the same as that of a permanent employee)

Office Location

Roppongi

• Smoking is prohibited within our offices
• Mercari has introduced a work style policy called “Your Choice.” Each member is free to choose whether they want to work in the office or work fully remote. *Exceptions made for certain kinds of work

Work Hours

• Scheduled working hours: 10 AM – 7 PM
• Currently, due to COVID-19 pandemic, we have introduced a full-flex system without core time to increase the choice of working hours and allow for more flexible working styles (*does not apply to all positions)

Holidays

• Two days off per week (as well as national holidays, New Year's break, etc.)
• Paid leave, congratulatory and bereavement leave, relax days, sick leave

Salary

• Annual salary paid in 12 monthly installments (including fixed overtime allowance)
• Based on skills, experience, and abilities
• Reviewed twice a year

Benefits

• Complete health and social insurance
• Incentive program
• Support systems, including those that benefit employee family members
• Language learning support
• Translation/interpretation support
• *See this page for details

Support

• Relocation Support
  *See this page for details

Additional details

Media

Corporate Sites

• Mercari, Inc.
• Merpay, Inc. [Japanese]
• Souzoh, Inc.
• Mercoin, Inc. [Japanese]
• Mercari US

Owned Media

• Mercari Careers
• Mercari Engineering Portal
• Mercan - Introduces the people that make Mercari
• Mercari US Careers
• Mercari US Blog