[Infra Div.] DevSecOps/공급망 보안 엔지니어 (5~8년)

📋 Job Overview

We pioneer the path to players' dreams. With bold imagination and breakthrough technology, we create unforgettable worlds for fans across the globe.

🏢 About KRAFTON

KRAFTON Security Team is composed of Defensive Security and Offensive Security, responsible for the security of services and infrastructure across Krafton headquarters, PUBG, and other studios and subsidiaries. We examine vulnerabilities from an attacker's perspective, operate detection and response systems, and actively utilize AI in all security operations.

🎯 The Role

Our team is looking for a DevSecOps Engineer to join us in building and maintaining security systems for our game services and internal services. We are responsible for regular vulnerability assessments, security incident response, and implementing security measures across our development lifecycle.

✅ Key Responsibilities

• Operate regular vulnerability assessments for game services and internal services, send remediation requests, and track/revalidate compliance
• Integrate SAST, DAST, SCA, and Secret detection into GitHub/GitLab CI/CD pipelines and establish automated remediation request systems
• Prioritize and manage CVEs based on impact, reachability, and exploit status with SLA tracking
• Monitor and respond to open source supply chain attacks (malicious packages, dependency confusion, maintainer account hijacking) and establish SBOM, artifact signing, and origin verification systems
• Leverage LLM and AI agents for detection result classification, remediation guide generation, and automation of repetitive inspection, analysis, and reporting tasks

📌 Required Qualifications

• 5-8 years of practical experience in DevSecOps or application security
• Experience integrating SAST, DAST, SCA checks into GitHub Actions or GitLab CI environments and operating them
• Experience delivering vulnerability assessment results to development teams and tracking completion until remediation
• Experience building or operating open source supply chain security (SBOM, dependency management, malicious package response) systems
• Ability to write or modify security automation scripts and tools using Python or one or more languages
• Experience using LLM/AI tools for security tasks, able to explain effectiveness and reproduce results
• No disqualifying reasons for overseas business trips

⭐ Desirable Experience

• Experience analyzing and responding to actual supply chain attack incidents and establishing prevention measures
• Experience with artifact signing and origin verification systems (Sigstore, SLSA)
• Customization and detection rule writing experience with security tools (Semgrep, CodeQL, Trivy, Dependency-Track)
• Experience operating vulnerability remediation request and issue tracker integration processes in large repository environments
• Security experience in CI/CD environments (container images, Kubernetes, IaC)
• Supply chain security verification experience with AI agent tools (MCP, plugins)

🎁 Benefits

5-month probation period applies. Company may terminate employment early or not continue based on evaluation results. No changes in employment type or salary during this period.

🛂 Visa & Eligibility

No disqualifying reasons for overseas business trips.