1. Participate in the establishment of the company's application security framework, including implementing security reviews prior to application deployment, and promoting processes for code security, application component security, black-box and interactive application security testing, and code release;

2. Responsible for the overall security testing of business operations and conducting security audits of the code prior to deployment;

3. Research the use of static code analysis techniques for vulnerability detection and analysis, and implement corresponding core algorithms or tools;

4. Responsible for the evaluation of static code analysis tools and enhancing their inspection capabilities; intercepting and reducing security risks of the company's products through these tools.

5. Develop and improve security technical specifications, including but not limited to secure development guidelines and security assessment testing protocols.

1. Bachelor's degree or above, with more than 2 years of experience in the information security field;

2. Proficient in code auditing skills, with expertise in one or more code auditing languages (such as PHP/Java/Golang, etc.);

3. Familiar with the principles and architecture of mainstream commercial or open-source static code analysis tools;

4. Understand the principles of common vulnerabilities and their protective measures, as well as the principles and methods for static analysis of these vulnerabilities;

5. Experience in developing static analysis detection tools, and experience in program analysis algorithms or using formal methods for static code analysis is preferred.