App Security Engineer

Application Security Engineer - GSM platform
📍 Location: Hanoi - Technopark Tower / Ho Chi Minh City - Vincom Dong Khoi
🛡️ Department: Cyber Security
🚀 Full-time
About the Role
We are looking for an
Application Security Engineer
to help embed security into every stage of the software development lifecycle. In this role, you will work closely with Engineering, DevOps, and Product teams to identify security risks early, secure cloud-native environments, and build scalable security automation that enables fast and secure product delivery.
What You'll Do
Secure Design & Threat Modeling
Participate in sprint planning and architecture/design reviews to identify security risks and attack surfaces early.
Develop threat models for critical business features, including payments, real-time location services, and partner integrations.
Collaborate with engineering teams to incorporate security requirements into system design and acceptance criteria.
Application Security Testing & Vulnerability Management
Conduct SAST, DAST, manual code reviews, and security assessments focusing on:
OWASP Top 10
API and Mobile Security
Business logic flaws
Abuse cases
Perform sprint-based and periodic penetration testing.
Investigate, reproduce, and triage vulnerabilities to determine root causes and business impact.
Partner with engineering teams to remediate findings and ensure SLA compliance.
DevSecOps & Security Automation
Integrate security tooling into CI/CD pipelines (GitHub Actions, GitLab CI).
Implement and optimize:
SAST
Software Composition Analysis (SCA)
Secret Scanning
Tune detection rules to reduce false positives and improve effectiveness.
Build security gates that balance risk management and development velocity.
Leverage AI/LLM technologies to enhance security automation and engineering productivity.
Cloud & Infrastructure Security
Review and assess cloud environments across AWS and GCP.
Evaluate IAM policies, cloud storage configurations, container security (GKE/EKS), and network controls.
Conduct Cloud Security Assessments aligned with CIS Benchmarks.
Identify and remediate common cloud misconfigurations, including:
Over-privileged access
Publicly exposed storage
Unencrypted secrets
Weak network controls
Security Culture & Enablement
Contribute to internal Security Champion programs.
Develop security guidelines, standards, and engineering checklists.
Deliver security awareness and secure coding training sessions for engineering teams.
What We're Looking For
Required Qualifications
From 3+ years of experience in Application Security, Penetration Testing, or Secure Software Development.
Strong understanding of OWASP Top 10 (Web, API, and Mobile Security).
Hands-on experience with security testing, vulnerability assessment, or penetration testing.
Ability to read, understand, and review code in at least one backend language such as Go, Java, Python, or [protected info]
Experience using security tools such as Burp Suite, Semgrep, SonarQube, Checkmarx, or similar.
Good communication and stakeholder management skills.
Solid understanding of networking and web protocols (TCP/IP, HTTP/HTTPS, UDP).
Nice to Have
Security certifications such as OSWE, CEH, GWEB, AWS Security Specialty, or equivalent.
Experience building or maintaining internal security tooling and custom detection rules.
Knowledge of Supply Chain Security and Software Composition Analysis.
Participation in Bug Bounty programs (HackerOne, Bugcrowd) with recognized submissions.
Experience in fintech, e-commerce, super apps, or payment platforms.
Familiarity with security and compliance frameworks such as PCI-DSS