Automation Compliance Engineer, IT Compliance (2026 Graduate)

About the team Shopee will be prioritizing applicants who have a current right to work in Singapore , and do not require Shopee sponsorship of a visa . Kindly note that you can only be considered in one recruitment process at a time within Sea Group and will be considered for jobs in the order that you have applied . The IT Compliance team acts as the organization’s "IT doctors," partnering with business teams to deliver technological solutions that enhance Shopee’s user experience. A key focus is ensuring our product solutions meet regulatory standards by obtaining necessary certifications, achieved through close collaboration with internal and external stakeholders. This process not only ensures compliance but also provides the team with a deep understanding of regional business landscapes and cross-functional collaboration, enabling us to drive long-term, impactful solutions as the organization grows. Responsibilities Design and implement workflow‑based control automation for Regulatory Standards (e.g., ISO, PCI) and SOX 404 ITGCs, using: Explicit start–action–evidence–end flows. Triggers from tickets, change‑management systems, HR events, or IAM changes. Delivered via tools such as n8n, Camunda, Azure Logic Apps, or custom MCP‑style servers. Build and operate MCP‑style or MCP‑compatible servers that expose: Tools: RESTful endpoints for “trigger evidence collection”, “run access review”, “validate change ticket”, etc.. Resources: Standardized data sources (logs, IAM, ticket data) formatted for AI agents or workflow engines. Auth patterns: API keys, bearer tokens, OAuth2, or OIDC‑style flows that can be consumed by agents or external tools. Engineer API‑first automation: Write scripts and connectors (Python, Node.js, Bash, etc.) that call, compose, and orchestrate APIs from: IAM, IdP, PAM, HRIS, ticketing, cloud IAM, and logging platforms, etc. GRC platforms (e.g., ServiceNow, 6clicks, or similar) via REST APIs. Implement: Authentication and authorization (API keys, Bearer, OAuth2, JWT, Basic, MTLS). Pagination, retry with backoff, rate‑limiting, and safe error handling. Idempotency and safe state transitions for audit‑critical operations. Translate ISO 27001 controls and SOX 404 ITGCs into automated workflows: Example pattern: Trigger: new user join or role change in IAM. Action: call APIs to validate entitlements, cross‑check against SoD, and emit evidence to a GRC tool. Outcome: workflow‑generated record for ISO 27001 access control and SOX logical‑access control. Maintain one source of truth for control logic (code / config) and use workflow IDs as control‑evidence bindings. Design AI‑agent‑ready interfaces: Expose structured, MCP‑style endpoints or OpenAPI specs so that LLM agents or workflow tools can call concrete tools (e.g., “get latest access review for System X”, “run change‑ticket‑completeness check”). Handle dynamic policy enforcement: short‑lived tokens, context‑aware access, and audit logging for each AI or agent call. Integrate with data platforms and SIEM/logging: Use logs, change tickets, and identity events as workflow inputs. Build automated tests for control effectiveness (e.g., “if a production change is not approved, fire an alert and record as control failure”) linked to ISO / SOX control IDs. Maintain audit‑ready workflow artifacts: Log all workflow steps, including timestamps, input, user/agent context, and outputs. Ensure workflow outputs are machinable (JSON, structured logs) and can be replayed or reasoned over by auditors or AI agents. Requirements Bachelor's degree or above in computer science, computer engineering or related disciplines. Strong understanding of authorization and authentication: API keys, Bearer tokens, OAuth2 (client, JWT, PKCE), Basic Auth, MTLS, and OIDC‑style flows. Hands‑on experience implementing these in Python, Node.js, or Go (or similar). Deep practical experience with: RESTful APIs: understanding of HTTP methods, status codes, pagination, rate‑limiting, and…