Security Engineer

📍 Tokyo, Japan or 🌎 Remote

🏢 Mercari

Advanced relocation package

Adaptation tips

Flight ticket

Temporary housing

Visa services

Rental deposit coverage

About Mercari

We believe the world needs a place where people can exchange their loved goods. That’s why we built Mercari—to connect people who want to buy and sell things of emotional value through their mobile phones. Mercari has grown to become a leading community-powered marketplace that brings together millions of people every day.

Mercari Dev Meetups

Position

Remote work is also possible.

Mercari’s culture has been central to the company since our founding, with the three core values of Go Bold, All for One, and Be a Pro. In addition, the “Trust & Openness” value was introduced to embody our culture of mutual trust, where information remains transparent and rules are kept to a minimum. Regardless of how big Mercari gets, our culture is essential to achieving our mission and will be promoted throughout our organization.

Work Responsibilities

As a Security Engineer in the Mercari Security Engineering Team, you will perform security design and process reviews as well as develop and deploy security countermeasures, and execute penetration tests. This is a unique role within Mercari since you will be involved in high-stakes projects across the organization. In addition, you will help us ensure the integration of and compliance with security best practices, frameworks, and regulations in these projects
Mercari follows the philosophy of “security as code”, so our security engineers are expected to automate and optimize the solutions they develop. That’s why we are looking for people passionate about automation to join our team! Specifically, you will:
- Review system designs to define necessary security requirements based on threat evaluation and attack trees
- Review architecture proposals, such as infrastructure or information flows, and propose security controls to minimize risks
- Conduct vulnerability assessments and penetration testing on Mercari’s production and corporate infrastructure
- Automate security controls and monitoring
- Develop technical solutions to help mitigate security vulnerabilities
- Maintain technical & security standards for production and corporate infrastructure services
- Educate engineering teams on security practices with hands on workshops, tech talks, and lectures
- Participate in the incident response process, identify remediation actions and deploy countermeasures
- Collaborate with information security officers, the legal team, and internal auditors on technical security matters

Bold Challenges

Security Engineers at Mercari are responsible for dealing with a vast array of data, logs, and dependencies. You will be able to use cutting-edge and complex cloud infrastructure systems to help us tackle unknown issues
With rapidly growing organizations and services, it is extremely important for Mercari to introduce automation and stop depending on manual work as much as possible. This is an exciting opportunity to gain experience helping us build our security systems and solve issues in a fast-paced environment

Your qualification

4+ years of experience in security domains
Programming experience with one or more programming languages including but not limited to: Go, Python, PHP, Javascript
Public cloud infrastructure platforms (GCP, AWS and Azure), as well as container technologies (Docker, Kubernetes)
Penetration testing, web application security testing, vulnerability scanning, threat-based infrastructure risk assessment
Security automation and DevSecOps methodologies
Corporate security solutions (DLP, IAM, MDM, Endpoint security/EDR, CASB, ZeroTrust, MFA)
Implemented security controls based on security frameworks and regulations (ISO27001, PCI-DSS, CCPA)
Key management and applied cryptography (TLS, PKI, KMS, blockchain, data encryption)

Will be a plus

Bachelor's degree in Computer Science or equivalent practical experience
Good understanding of modern web application architecture
Recognized security certifications (CISSP, OSCP, GIAC)
Experience leading or investigating in incident handling cases, performed computer forensic investigations, or malware analysis
Experience with software development tools, such as version control systems, integrated development environments (IDE), and CI/CD tools
SQL Querying (BigQuery, Mysql)
Effective interpersonal and communication skills

Screening Criteria

Foundation in, and in-depth technical knowledge of, security engineering, computer and network security, operating system security, authentication, security protocols and applied cryptography
Understanding of HTTP, TCP/IP, and standard network and system security technologies fundamentals
Coding experience in Go, PHP, JavaScript or Python; experience with mobile security is a plus (iOS and Android applications)
Programming, Domain Driven Design, and Test Driven Design
Self-motivated and results-oriented
Good understanding of microservices architecture
Knowledge of container and orchestration technology like Docker and Kubernetes
Experience working on cloud infrastructures like GCP or AWS
Experience working in a DevOps/Agile environment
Enjoy programming and automation
Enjoy working across engineering teams to help define architecture requirements and deliver projects securely
Strong teamwork skills in a diverse environment

Technical Assessment Criteria

Technical test
Technical interview
Follow-up exercises
Interview
Final interview

*See this page for details

Language Requirements

English or Japanese: Independent (CEFR-B2)
*For details about CEFR, see here
- The Security Team is a diverse team with members from around the globe. Team members have various levels of Japanese and English proficiency and we value mutual effort, understanding, and support, and we aim to meet in the middle to make everyone feel comfortable regardless of the member’s native language

What we offer

Employment Status

Full-time

Probationary period: First 3 months after joining the company (During this period your contract conditions will be the same as that of a permanent employee)

Office Location

Roppongi

Smoking is prohibited within our offices
Mercari has introduced a work style policy called “Your Choice.” Each member is free to choose whether they want to work in the office or work fully remote. *Exceptions made for certain kinds of work

Work Hours

Scheduled working hours: 10 AM – 7 PM
Currently, due to COVID-19 pandemic, we have introduced a full-flex system without core time to increase the choice of working hours and allow for more flexible working styles (*does not apply to all positions)

Holidays

Two days off per week (as well as national holidays, New Year's break, etc.)
Paid leave, congratulatory and bereavement leave, relax days, sick leave

Salary

Annual salary paid in 12 monthly installments (including fixed overtime allowance)
Based on skills, experience, and abilities
Reviewed twice a year

Benefits

Complete health and social insurance
Incentive program
Support systems, including those that benefit employee family members
Language learning support
Translation/interpretation support
*See this page for details

Support

Relocation Support
*See this page for details

Additional details

Media

Corporate Sites

Owned Media

Archive vacancy