Class of 2028 / New Graduate Security Engineer - Mercari Group

Location: Minato City, Tokyo, Japan (Hybrid)
Employment Status: Permanent (New Graduate)
Office: in Japan (Roppongi)
Target Applicants: Those who can join as new graduates in October 2027 or April 2028
Application Deadline: December 31, 2026, 23:59 (JST)

---

Description

As a member of the Mercari Security Engineering Team, you will review security designs and processes, develop and deploy security countermeasures, and conduct penetration tests. Security engineers are involved in projects that impact the entire organization, providing opportunities for holistic growth and leadership development.

Example Responsibilities

• Monitoring, log analysis, and development of logging infrastructure
• Performing security reviews and creating threat models
• Designing and implementing security automation or dashboards
• Web and mobile application security testing
• Technical project management

---

Work Responsibilities

• Participate in threat modeling, code reviews, and security testing under the guidance of senior engineers to help identify and reduce risk in Mercari’s systems.
• Develop or enhance automation scripts for common security tasks such as compliance checks, asset inventory reconciliation, and alerting.
• Conduct focused security research on a supervised topic (e.g., AI system security, supply chain risks), summarize key findings, and propose actionable improvements for Mercari.
• Support vulnerability management processes by helping triage security findings, verify issues, and coordinate with developers on remediation efforts.
• Contribute to internal documentation, including secure development guidelines, AI security best practices, security playbooks, and onboarding material for engineers.
• Assist in security monitoring efforts, such as analyzing logs to detect anomalies, tuning detection rules, and helping track misconfigurations or policy violations.

---

About Our Teams

• Threat Detection and Response Team: Develops and operates Mercari Group’s security monitoring, detection engineering, and incident response capabilities.
• Platform Security Team: Develops and operates security controls and guardrails for Mercari's engineering platform, covering access management, CI/CD security, supply chain risk management, and Kubernetes security.
• Product Security Team: Ensures applications are built securely through threat modeling, security architecture reviews, automated scanning, and penetration testing; manages vulnerability disclosure and secure coding standards.
• Enterprise Security Team: Operates scalable security controls for the global workforce platform, embedding Zero Trust and defense-in-depth principles.

---

Why Mercari is a Great Place to Learn Security Engineering

• Cutting-Edge Infrastructure: Built on GCP, Kubernetes, Terraform, advanced AI, and automation tools.
• Real-World Impact at Scale: Systems support tens of millions of users, tackling complex security problems.
• A Culture of Innovation: Experimenting with AI-driven development, zero trust architecture, and secure-by-design initiatives.
• Mentorship & Collaboration: Guided by experienced security engineers focused on knowledge-sharing and talent-building.

---

Unique Challenges

• Opportunity to employ complex cloud infrastructure systems and tackle new challenges involving vast arrays of data, logs, and dependencies.
• Responsibility to introduce automation and reduce manual work in a fast-paced, rapidly growing environment.

---

Qualifications

Required Experience/Skills

• Shared understanding and belief in our company’s mission and values
• Strong interest in cybersecurity and engineering
• Programming experience with one or more programming languages including but not limited to: Go, Python, PHP, JavaScript
• Enrolled in a Bachelor's degree (or higher) program or technical school in Computer Science, Information Security, or other engineering-focused major
• Effective interpersonal and communication skills
• Basic familiarity with Linux, including common commands and scripting
• Foundational knowledge of SQL and data querying

Preferred Experience/Skills

• Basic understanding or strong interest in any of the following:
  • Experience attending or speaking at domestic and international security conferences, such as SECCON, Hardening Project, Black Hat, or DEF CON.
  • Hands-on experience in security practices such as participating in CTF (Capture The Flag) competitions, bug bounty programs, or penetration testing.
  • Knowledge of Web or mobile application security testing.
  • Public cloud infrastructure platforms (GCP, AWS or Azure)
  • Container and orchestration technologies (Docker, Kubernetes)
  • Security automation and DevSecOps
  • Experience leveraging AI for security operations automation and the protection of AI-driven systems
  • Basic experience with software development tools such as Git, dependency management, build and deployment tools
  • Understanding of modern Web or mobile applications

---

Language

• English or Japanese: Independent (CEFR-B2)
  The Security Team is a globally diverse group with a wide range of Japanese and English proficiency levels, valuing mutual respect, empathy, and inclusivity.

For CEFR details: CEFR Information

---

Learn More About Mercari Group

• Careers site
• Mercan
• Social media: X / LinkedIn

---

Hiring Process at Mercari Group

1. Application screening
2. Skill assessment: Completed via HackerRank
3. Interview: Three rounds
4. Offer: Determined based on the final interview

---

Equal Opportunity Hiring

Mercari is committed to realizing a world where no one’s potential is limited by their background. We strive for inclusion and diversity in all hiring practices, actively eliminating discrimination based on age, gender, sexual orientation, race, religion, physical disability, and other factors. For more details, please read our I&D statement.

---

Please read and acknowledge our Privacy Policy prior to submitting your application.