K

KRAFTON

Develops and publishes cross-platform games

DevSecOps / Supply Chain Security Engineer

Security Engineering & ArchitecturePosted on Nov 9
Full-timeSeoul, South KoreaNo salary listed

About the Job

Requirements

  • Have 5–8 years of practical experience in DevSecOps or application security.
  • Have experience integrating and operating SAST, DAST, and SCA checks in GitHub Actions or GitLab CI environments.
  • Have experience communicating vulnerability assessment results to development teams and tracking remediation through completion.
  • Have experience establishing or operating open-source supply-chain security practices, including SBOMs, dependency management, or malicious package response.
  • Be able to write or modify security automation scripts and tools in Python or another programming language.
  • Have experience using LLM or AI tools in security work, explaining their effectiveness, and independently reproducing and verifying their results.
  • Be eligible to travel overseas.

Responsibilities

  • Operate regular vulnerability assessments for game and internal or external services, send remediation requests, track completion, and revalidate fixes.
  • Integrate SAST, DAST, SCA, and secret detection into GitHub or GitLab CI/CD pipelines and build automated workflows for remediation requests based on findings.
  • Prioritize CVEs identified in CI/CD and repositories based on impact, reachability, and exploitability, and manage remediation deadlines under SLAs.
  • Monitor and respond to open-source supply-chain attacks, including malicious packages, dependency confusion, and maintainer account compromise; establish and operate SBOM, artifact signing, and provenance verification practices.
  • Use LLMs and AI agents to classify findings, generate remediation guidance, and automate repetitive review, analysis, and reporting.

Desired Qualifications

  • Have analyzed and responded to an actual supply-chain attack and established measures to prevent recurrence.
  • Have experience implementing or operating artifact signing and provenance attestation tools such as Sigstore or SLSA.
  • Have experience customizing security tools such as Semgrep, CodeQL, Trivy, or Dependency-Track and writing detection rules.
  • Have experience operating vulnerability remediation request workflows and issue-tracker integrations in large repository environments.
  • Have security experience with CI/CD environments involving container images, Kubernetes, or infrastructure as code.
  • Have experience verifying the supply-chain security of AI agent tools such as MCP or plugins.

About the Company

KRAFTON

Develops and publishes cross-platform games

Krafton is a group of independent game studios that develops and publishes video games for PC, console, and mobile. Its business model centers on delivering high-quality games and monetizing them through game sales, in-game purchases, and licensing deals, with PUBG as a flagship title. Krafton differentiates itself by coordinating a network of studios and investing in technology and publishing support rather than relying on a single in-house studio, enabling a diverse catalog and esports initiatives. Its goal is to push the boundaries of gaming and connect people through shared entertainment moments across platforms.

Company size
51-200
Company stage
IPO
Headquarters
Seongnam-si, South Korea
Founded
2007

Recently Posted Jobs

Explore more opportunities at KRAFTON

See more jobs