Staff Security Engineer (DART)

Company Introduction

Coupang exists to deliver customer delight. We know we are fulfilling our mission when customers say, "How did we ever live without Coupang?" With the sole obsession of making customers' shopping, dining and everyday life easier, Coupang is driving innovation across the multi-billion-dollar e-commerce industry. Coupang is one of the fastest-growing e-commerce companies and has built a unique position in the domestic commerce industry and customer trust. 

Coupang considers itself a large global listed company built on a start-up culture. This preserves the agility of our founding days and is the growth engine behind our continuous launch of new services and expansion of our business. Every Coupang employee has the opportunity to embrace an entrepreneurial spirit and drive new innovations and initiatives. The boldness to dive into work without hesitation and strive for results is the essence of how Coupang works. At Coupang, you will witness yourself, your colleagues, your team and the whole company growing every day. 

Every Coupang employee is committed to the Coupang mission of creating the future of commerce. We solve customer problems, challenge conventional thinking and norms, and go beyond what is considered possible. If you want an amazing work experience in an always-on, high-tech and hyper-connected world, join Coupang today.

Job Introduction

DART (Detection and Response Team) is the organisation that detects and responds to cyber threats across Coupang, with the goal of minimising the potential impact of cybersecurity incidents on the organisation.  

Through in-depth analysis and threat hunting of various logs and artefacts collected via the SIEM platform, as well as suspected security incident cases received from the CSOC, when a potential security incident is identified, DART analyses the event to determine whether it is a real threat or a false positive, and assesses the potential impact of the incident. 

When confirmed as an actual security incident, DART identifies the root cause and carries out containment and mitigation measures to prevent further damage. By working with relevant departments to establish and implement long-term preventive controls, it reduces the likelihood of similar incidents recurring, identifies and responds to threats that bypass existing detection and response systems, and plays a role in further strengthening the organisation's overall security posture. 

Responsibilities

• Detection of security anomalies and analysis/response to intrusion attempts and security breaches (scope: all Coupang IT infrastructure)
• Identify security threats in unknown areas through Threat Hunting
• Prevent the spread of incidents through root cause analysis and initial response measures
• Respond to security incidents through analysis of system and network security and various application events
• Derive TTPs through static and dynamic analysis of malware and respond accordingly
• Develop, improve and respond to detection and response procedures for internal and external threats and abusive behaviour
• Provide technical support on incident response and information security to relevant departments
• Improve incident response policies, procedures and processes
• Perform on-call duties for emergency response to security incidents
• Collaborate smoothly with internal teams through effective communication

Requirements

• At least 12 years of information security practical experience and at least 8 years of experience in intrusion analysis and incident response
• Experience in security event analysis and security incident response
• Experience in host-based security investigation (Windows, Linux, Mac)
• Experience analysing security events from network security solutions (IPS/IDS, network monitoring solutions, NetFlow, etc.)
• Experience analysing security events from endpoint security solutions (EDR, HIPS, Anti-Virus, DLP, etc.)
• Experience analysing security events from applications (Web Application, Mobile App, Email Security, etc.)
• Strong understanding of public cloud environments and security incident analysis capability (AWS, Azure, GCP, etc.)
• Experience writing and using SIEM queries for log-based security event analysis
• Incident response capability through analysis of large-volume data or large-volume logs
• Able to communicate and collaborate smoothly
• Proactive and self-driven approach to work
• Bachelor's degree or equivalent practical experience

Preferred Qualifications

• Specialist knowledge of security threats relevant to the e-commerce industry
• Serverless architecture (e.g. Lambda, Azure Functions, etc.) and experience securing container and Kubernetes environments (e.g. Kubernetes, Docker)
• Experience improving detection environments based on analysis of external/internal network traffic, and experience in analysis and security incident response
• Security experience in DevSecOps, IaC (Infrastructure as Code) environments
• CI/CD pipeline security experience
• Experience building and operating orchestration for intrusion analysis and incident response
• Experience using Python, PowerShell, etc. for advanced analysis and automation

Selection Process and Notes

• Selection process
  • Document screening - job fit interview - core competency interview - final decision
  • The selection process may differ by position and may change depending on schedule and circumstances.
  • Schedule and results will be notified individually to the email registered on your application.
• Notes
  • This posting may close early once recruitment is complete.
  • If application details contain false information, the offer may be cancelled.
  • Employment protection recipients (veterans, persons with disabilities, etc.) may receive preferential treatment in accordance with relevant laws.
  • Job level and scope of responsibilities may be changed taking into account the candidate's overall career and experience. If such a change is necessary, the candidate will be contacted at an appropriate time before the final offer notification.
  • Recruitment may be restricted if legally required qualifications for hiring and performing the job are not met.

Personal Information Processing Policy 

• Coupang Group collects and processes your personal information in accordance with the Job Applicant Personal Information Processing Policy (link below). https://www.coupang.jobs/kr/privacy-policy/

Document Return Policy 

1. This notice is provided pursuant to Article 11(6) of the Act on Fair Hiring Procedures.
2. Applicants who were not finally selected may claim the return of the hiring documents they submitted in accordance with the Act on Fair Hiring Procedures. However, this does not apply to documents submitted via the website or by email, or to documents voluntarily submitted without the company's request. If hiring documents are lost due to natural disasters or other reasons not attributable to the company, they are deemed returned.
3. Applicants claiming the return of hiring documents under paragraph 2 above shall complete the hiring document return request form [Form No. 3 of the Enforcement Rules of the Act on Fair Hiring Procedures] and submit it by email to ([contact details removed]). Upon confirmation of submission, the documents will be sent by registered mail to the address specified within 14 days. In this case, the registered postage is payable by the recipient, so please bear this in mind. 
4. To prepare for return claims under paragraph 2 above, the company will retain the original hiring documents submitted by applicants for 180 days from the date hiring is confirmed. If no return claim is made by then, all hiring documents will be destroyed without delay in accordance with the Personal Information Protection Act.
5. However, paragraphs 1 to 4 above apply only where the labour laws of the Republic of Korea apply. They do not apply otherwise.