Security Engineer (Product Security)

📍 Tokyo, Japan or 🌎 Remote

🏢 Mercari

Advanced relocation package

Adaptation tips

Flight ticket

Temporary housing

Visa services

Rental deposit coverage

About Mercari

We believe the world needs a place where people can exchange their loved goods. That’s why we built Mercari—to connect people who want to buy and sell things of emotional value through their mobile phones. Mercari has grown to become a leading community-powered marketplace that brings together millions of people every day.

Mercari Dev Meetups

Position

Our Mission

Mercari is a Japan-based company with the mission of “create value in a global marketplace where anyone can buy & sell.” Having continuously worked toward this goal since our founding in 2013, we are now transforming from a startup into a global player. While this transformation brings its own specific set of challenges, we believe that solving them one after another will allow us to fully achieve our mission. Are you interested in working together to take on these exciting challenges?

Our Culture

Mercari’s culture has been central to the company since our founding, with the three core values of Go Bold, All for One, and Be a Pro. In addition, the “Trust & Openness” value was introduced to embody our culture of mutual trust, where information remains transparent and rules are kept to a minimum. Regardless of how big Mercari gets, our culture is essential to achieving our mission and will be promoted throughout our organization.

Position Overview

Work Responsibilities

Mercari is looking for a security engineer to join our Product Security Team in Tokyo. The Product Security Team ensures that Mercari products meet security requirements and investigates, tracks, and assists in fixing security issues. The team strives to be a business enabler working on a variety of tasks and applying a risk-based approach to security-related decision making
As a Product Security Engineer you will be responsible for eliciting and communicating security requirements to product teams, performing threat modeling, design reviews, and security testing. You will also be involved in evaluating, designing, developing, and deploying automated security assessment solutions (DAST, SAST, SCA, etc.) and take on the challenge of ensuring the safety of Mercari’s development lifecycle

Bold Challenges

Work with a modern, cloud-first development and deployment environment
This position will allow you to take full advantage of your skills and experience because you will work on a variety of projects ranging from an online marketplace to payments and IoT
Mercari offers a multicultural environment with colleagues from over 40 different countries and various backgrounds (experiences and skills), so you will be able to discuss and address issues from different perspectives and use that for personal growth

Roles and Responsibilities

Review product designs to define necessary security requirements based on threat modeling
Review proposed architecture and propose a set of security controls in order to minimize risk
Review source code to find security problems and potential vulnerabilities
Conduct vulnerability assessments and penetration testing on Mercari’s Web, iOS, and Android applications
Automate security checks and tests so that they can be easily and transparently plugged into the CI/CD pipeline
Develop technical solutions to help mitigate security vulnerabilities
Maintain technical and security standards for Web and mobile application technologies
Educate developers on secure coding practices with workshops, talks, and lessons
Evaluate and investigate suspected security events or incidents and perform remediation in accordance with Incident Response procedures
Collaborate with information security officers, the legal team, and internal auditors on technical security matters

Your qualification

2+ years of experience analyzing the security of systems (penetration testing, Web application security testing, vulnerability scanning, threat modeling, etc.)
Bachelor's degree or equivalent practical experience
Programming experience with one or more programming languages including but not limited to: Go, PHP, Java, Ruby, Python, C/C++, Objective-C, Swift, Kotlin, or JavaScript
Good understanding of modern Web application architecture, TLS, HTTP, TCP/IP, and standard network and system security technologies
Experience with modern software development tools, such as distributed version control systems (git), dependency management, build systems, and CI/CD pipelines
Effective interpersonal and communication skills
Strong teamwork skills in a diverse environment

Will be a plus

In-depth technical knowledge of security engineering, computer and network security, Unix-based operating systems, mobile security, authentication, security protocols, and applied cryptography
Good understanding of development methodologies such as Object-oriented Programming (OOP), Domain-driven Design (DDD), and Test-driven Development (TDD)
Strong experience in securing both backend (Go, PHP) and frontend (Web, JavaScript, iOS, Android) applications
Good understanding of microservice architecture and related security patterns
Knowledge of container and orchestration technology like Docker and Kubernetes
Experience working with large-scale cloud infrastructure and services (GCP or AWS)
Experience working in an agile and DevOps-centric environment

Screening Criteria

Technical experience
Communication skills
Culture fit to both the team and Mercari as a whole

Language Requirements

English or Japanese: Independent (CEFR - B2)
(either Japanese Independent (CEFR - B2) + English Basic (CEFR - A2) OR English Independent (CEFR - B2) + Japanese Basic (CEFR -A2)
For details about CEFR, see here

What we offer

Employment Status

Full-time

Probationary period: First 3 months after joining the company (During this period your contract conditions will be the same as that of a permanent employee)

Office Location

Roppongi

Smoking is prohibited within our offices
Mercari has introduced a work style policy called “Your Choice.” Each member is free to choose whether they want to work in the office or work fully remote.
*Exceptions made for certain kinds of work

Work Hours