Security Engineer | Famous Web Service

【ABOUT THE COMPANY】

Continuously refining products that anyone can easily use. The company provides EC/FinTech services that empower individuals and SMBs.

With the mission of "Payment to the People, Power to the People," the company is developing EC/payment/financial services for individuals and small teams with the aim of creating a world where people around the world can freely engage in economic activities.

【JOB DESCRIPTION】

■About the company
With "Payment to the People, Power to the People" as its mission, the company is developing EC/payment/financial services with the aim of empowering individuals and small teams to create a world where people around the world can freely engage in economic activities.

The company's main service, the online store creation service, is used by various store owners all over Japan, and has become one of the largest online store creation services in Japan, with over 1.5 million stores created so far.

The service for buyers will be rebranded as a shopping service in 2021, and will focus on providing a new payment experience, building sustainable relationships between stores and buyers, and promoting purchases.

■About the position
As a Security Engineer, you will be responsible for improving the reliability of our services.
In order to handle the information of many store owners and purchasers, it is urgent to improve security so that they can use the site with peace of mind.

The company expects you to develop a process for handling vulnerabilities and security protection measures that have become the responsibility of individuals in the development process and infrastructure construction and operation to improve the quality of services.

In this position, you will be mainly responsible for the security of the service side. In some cases, you may also be involved in internal controls and internal security.

■Responsibilities
・Regular handling of vulnerability assessment and triage of the results
・Conducting drills assuming that a security incident will occur
・Fixing application vulnerabilities
・Security audit of AWS infrastructure
・Consideration of protective measures against unauthorized requests that occur daily
・Review of internal security

■Recruitment Background
The team will need to handle a lot of personal information in the company.
This includes the personal information of store owners, purchasers, and many others.
Security is very important to keep this information safe and to allow people to use our services with confidence.

They need to strengthen the security of the infrastructure built on AWS and the security assurance of the applications running mainly on PHP.
Since you will be an initial member of the security organization, you will be involved in design, operation, and application modification on your own initiative with as much authority and discretion as possible.

■Development Environment
・Server-side languages: PHP, Golang, Python
・Server-side framework: CakePHP
・Infrastructure: AWS (EC2, ECS, Fargate, S3, Lambda, SNS, SQS, API Gateway)
・Web Server: Nginx, Apache
・Server OS: CentOS, Ubuntu
・DB: Amazon Aurora MySQL, Amazon Elasticache (Redis/Memcached)
・Image Distribution: Akamai, ImageFlux, S3
・CI/CD tools: CircleCI
・Search: Amazon CloudSearch / Amazon Elasticsearch
・Mobile Push: AWS Lambda, Firebase Cloud Messaging
- Monitoring: Mackerel, New Relic One
- Source code management: GitHub
- Configuration management: Terraform, Chef, Packer
- Chat tools: Slack

----------------------------------------------------

【Annual salary 】

6 million yen ~ 11 million yen

【 Working time 】

Flextime System

【 Welfare 】

■2 days off per week, national holidays
■Paid vacations (10 days granted on the first day of employment), summer vacation, New Year vacation, congratulation and condolence leave, and various other vacations
■Commuting allowance (up to 50,000 yen/month)
■Various types of social insurance: unemployment insurance, worker's accident compensation insurance, health insurance, employee pension insurance

【Required】
・Expertise in security (security alerts, log analysis, vulnerability triage of various middleware)
・Experience in PHP application development and operation to fix vulnerabilities
・Experience in using and responding to external vulnerability assessments
・Knowledge of development and design/build using AWS, and experience in service operation
　（Knowledge of AWS development and design/build, experience in service operation.)
・Experience and awareness of working on a web service that runs 24 hours a day, 365 days a year

【Preferred】
・Experience working with CSIRT/PSIRT
・Experience working with security-related certifications such as PCI/DSS and ISMS
・Experience in dealing with unauthorized access in a large-scale service
・Experience with secure coding
・Experience in developing internal security processes
・Experience in solving issues with a technical approach

【Ideal Applicants】
・Share the company's mission "Payment to the People, Power to the People" and be able to solve problems for the growth of the product
・Have an orientation in line with the three action guidelines "Be Hopeful", "Move Fast", and "Speak Openly".
・Love the Internet and have a strong interest in web services and applications
・Enjoys constantly changing situations and is able to respond flexibly to change
・Enjoy the growth and success of the owners as well as the growth and success of the members involved
・Able to work autonomously to identify and solve problems.
・Have a strong desire to use technology for the betterment of the product, without being obsessed with a specific technology
・Able to think about security and operations in a well-balanced manner and propose solutions through communication with development members