App Security Engineer

Application Security Engineer - GSM platform

📍 Location: Hanoi - Technopark Tower / Ho Chi Minh City - Vincom Dong Khoi

🛡️ Department: Cyber Security

🚀 Full-time

About the Role

We are looking for an Application Security Engineer to help embed security into every stage of the software development lifecycle. In this role, you will work closely with Engineering, DevOps, and Product teams to identify security risks early, secure cloud-native environments, and build scalable security automation that enables fast and secure product delivery.

What You'll Do

Secure Design & Threat Modeling

• Participate in sprint planning and architecture/design reviews to identify security risks and attack surfaces early.
• Develop threat models for critical business features, including payments, real-time location services, and partner integrations.
• Collaborate with engineering teams to incorporate security requirements into system design and acceptance criteria.

Application Security Testing & Vulnerability Management

• Conduct SAST, DAST, manual code reviews, and security assessments focusing on:
• OWASP Top 10
• API and Mobile Security
• Business logic flaws
• Abuse cases
• Perform sprint-based and periodic penetration testing.
• Investigate, reproduce, and triage vulnerabilities to determine root causes and business impact.
• Partner with engineering teams to remediate findings and ensure SLA compliance.

DevSecOps & Security Automation

• Integrate security tooling into CI/CD pipelines (GitHub Actions, GitLab CI).
• Implement and optimize:
• SAST
• Software Composition Analysis (SCA)
• Secret Scanning
• Tune detection rules to reduce false positives and improve effectiveness.
• Build security gates that balance risk management and development velocity.
• Leverage AI/LLM technologies to enhance security automation and engineering productivity.

Cloud & Infrastructure Security

• Review and assess cloud environments across AWS and GCP.
• Evaluate IAM policies, cloud storage configurations, container security (GKE/EKS), and network controls.
• Conduct Cloud Security Assessments aligned with CIS Benchmarks.
• Identify and remediate common cloud misconfigurations, including:
• Over-privileged access
• Publicly exposed storage
• Unencrypted secrets
• Weak network controls

Security Culture & Enablement

• Contribute to internal Security Champion programs.
• Develop security guidelines, standards, and engineering checklists.
• Deliver security awareness and secure coding training sessions for engineering teams.

What We're Looking For

Required Qualifications

• From 3+ years of experience in Application Security, Penetration Testing, or Secure Software Development.
• Strong understanding of OWASP Top 10 (Web, API, and Mobile Security).
• Hands-on experience with security testing, vulnerability assessment, or penetration testing.
• Ability to read, understand, and review code in at least one backend language such as Go, Java, Python, or Node.js.
• Experience using security tools such as Burp Suite, Semgrep, SonarQube, Checkmarx, or similar.
• Good communication and stakeholder management skills.
• Solid understanding of networking and web protocols (TCP/IP, HTTP/HTTPS, UDP).

Nice to Have

• Security certifications such as OSWE, CEH, GWEB, AWS Security Specialty, or equivalent.
• Experience building or maintaining internal security tooling and custom detection rules.
• Knowledge of Supply Chain Security and Software Composition Analysis.
• Participation in Bug Bounty programs (HackerOne, Bugcrowd) with recognized submissions.
• Experience in fintech, e-commerce, super apps, or payment platforms.
• Familiarity with security and compliance frameworks such as PCI-DSS