Cloud Engineer

Cloud Security Engineer (AWS / GCP / Multi-Cloud) - Hanoi / Ho Chi Minh City
About the role
VinSmart Future runs multi-cloud infrastructure on AWS, Google Cloud (GCP) and Huawei Cloud, serving products for both domestic and global markets. We are hiring 3 Cloud Security Engineers for our Security Engineering team. The team owns infrastructure security: Cloud Security Posture Management (CSPM), IAM governance, network security and cloud incident response.
You will work hands-on with DevOps to fix real security findings, build security controls as code and protect cloud workloads on Kubernetes and serverless platforms.
What you'll do
Vulnerability remediation with DevOps
Work with DevOps engineers to find the root cause of each security finding, measure its impact and plan the fix for each environment.
Make the technical changes yourself: IAM policies, Security Groups, S3 bucket policies, Network ACLs, Kubernetes RBAC and Terraform modules.
Check that each fix works on staging and production, and close every finding with technical evidence.
Review and harden Dockerfiles, GitLab CI/CD pipelines and Jenkins Shared Libraries (secrets management, container image signing, least-privilege execution).
Multi-cloud security assessments
Run regular cloud security assessments against CIS Benchmarks, the AWS Well-Architected Security Pillar, GCP Security Foundations and Huawei Cloud security best practices.
Audit IAM: excessive permissions, cross-account trust relationships, service account key exposure and privilege escalation paths.
DevSecOps automation & Policy-as-Code
Build preventive guardrails as code: AWS Service Control Policies (SCPs), GCP Organization Policies and Huawei Cloud Config rules.
Build automated detective controls with OPA/Rego, AWS Config custom rules and Security Command Center custom modules, so drift from the baseline is caught as soon as it appears.
Maintain cloud security dashboards and alert thresholds for AWS Security Hub, Amazon GuardDuty, GCP Security Command Center and CSPM findings.
Threat detection & incident response
Investigate alerts from Amazon GuardDuty, GCP Security Command Center and other detection tools.
Join cloud incident response: log analysis, lateral movement tracing, blast radius assessment and containment.
Security governance & documentation
Write and update cloud security architecture docs, incident response runbooks and secure configuration baselines.
Run threat modeling for new systems and major architecture changes (managed services, serverless, container platforms).
Send regular cloud security posture reports to the Security Engineering Lead and stakeholders, with trends and improvement proposals.
What we're looking for
Must-have
3+ years of hands-on experience as a Cloud Security Engineer, Cloud Engineer or DevOps Engineer with a security focus.
Hands-on experience with AWS and/or Google Cloud (GCP). Multi-cloud experience is a strong plus.
Deep knowledge of the IAM model of at least one cloud provider: roles, policies, trust relationships, AWS STS, GCP Workload Identity and service accounts.
Ability to read, review and change Terraform (Infrastructure as Code): resource dependencies, module structure and state management.
Strong Kubernetes security skills: RBAC, NetworkPolicy, Admission Controllers, Pod Security Standards, secrets management (External Secrets, HashiCorp Vault Agent).
Experience with at least one CSPM tool: AWS Security Hub, GCP Security Command Center, Wiz, Orca Security, Lacework or Prisma Cloud.
Nice-to-have
Has written OPA/Rego policies or AWS Config custom rules in production.
Cloud penetration testing experience: AWS privilege escalation, GCP lateral movement, metadata service (IMDS) exploitation.
Certifications: AWS Certified Security - Specialty, Google Professional Cloud Security Engineer, CCSP or equivalent.