Joel Chang

experience

• Senior Security Engineer · Sea

  Jan 2025 – Present

  Full-time · Singapore · Hybrid

  • VAPT / Source code review / Product Security: Led the first security review against our internal AI infrastructure and products, uncovering multiple vulnerabilities and establishing secure workflows and pipelines for continuous detection on the AI products.
  • Vulnerability Management: Led vulnerability management and bug bounty programs, automating workflows and driving cross-team collaboration to ensure timely remediation and eliminate recurring vulnerabilities across all assets.
  • Security Engineering: Built an internal tool for detecting data leakages across public and internal platforms, leveraging AI models to reduce false-positive rates.

• Security Engineer · Sea

  Jun 2022 – Dec 2024

  A high-impact team with strong offensive security capabilities, engineering security products for large-scale monitoring and detection.

  • VAPT / Source code review / Product Security: Oversaw product security across Shopee, SeaMoney and Garena, leading the discovery and mitigation of new attack surfaces and integrating SAST and DAST tools into the SDLC.
  • Vulnerability Management: Managed the bug bounty program and automated the internal vulnerability management workflow for timely remediation.
  • Security Engineering: Built an internal vulnerability scanning tool for continuous external attack surface monitoring, surfacing numerous systemic application and infrastructure vulnerabilities.
  • Security Research: Led a team at SpiritCyber 2024, placing 2nd overall in total bounty earned through coordinated offensive testing and disclosure.

  Tech stack: Python · MySQL · Docker

• Security Engineer Intern · Sea

  Jun 2021 – May 2022

  Singapore

• Undergraduate Teaching Assistant · NUS

  Aug 2020 – Dec 2020

  Part-time

  • Supported academic and administrative responsibilities for CS2113T: Software Engineering & Object-Oriented Programming.
  • Assisted two student groups with logistical support for managing their software engineering projects.

• Cybersecurity Research Intern · National Cybersecurity R&D Lab (NCL)

  May 2020 – Aug 2020

  Designed, developed and implemented custom in-house tools for automating security processes and workflows.

  • Collaborated with security researchers to build custom in-house automation tools.
  • Deployed, maintained and enhanced the organization's security tools and processes.
  • Conducted research on security tools and practices, including a proof-of-concept implementation.

• Advisor · NUS Orbital

  May 2020 – Jul 2020

  Project management and advisory for 5 groups of students.

  • Provided logistical support for five student groups building web and mobile applications.
  • Conducted a tutorial on security best practices for web and mobile application development.

education

licenses & certifications

vulnerability research