Lead a team of five running enterprise vulnerability management and the bug bounty program across Shopee, Garena, SeaMoney, and banking entities. Drive offensive security reviews on in-house AI infrastructure and production systems, run red team engagements against high-value targets, and build LLM-based agents for triage automation and vulnerability detection.
Supported enterprise bug bounty operations and owned vulnerability triage and risk assessment across business units. Led penetration tests, source code reviews, and red team operations against high-value assets, and built an internal data-leak detection tool with an LLM agent that cut false positives by 20–30%.
Helped run Sea's bug bounty platform and conducted security assessments, penetration tests, and source code reviews across Shopee, Garena, SeaMoney, and banking entities. Built a black-box DAST scanner for continuous asset monitoring, and represented the company at Govware SpiritCyber 2024 — placing 2nd overall in bounty earnings.
Managed HackerOne reports and streamlined the vulnerability reporting process. Performed source code reviews and penetration testing across multiple business units, and improved security scanner templates to raise detection rates.
Worked with security researchers to design and build custom in-house tooling that automated key security processes, and delivered proof-of-concept implementations of emerging security tools and practices.