DevSecOps Engineer (English required)

We are hiring a Senior DevSecOps Engineer to own the engineering platform and the security-and-compliance posture of the KM360 product family.
This is a DevOps role first: you will run Azure infrastructure, CI/CD pipelines, environments, identity and access for the whole engineering team. On top of that, you become the team's single point of accountability for Microsoft's security programs - cloud posture hardening, vulnerability remediation, security design and threat model reviews, privacy, and Responsible AI assessments - turning audit findings into engineering work and closing them. We are an AI-native engineering team, so there is a third dimension: we want this work automated.
If you can build agents and automated pipelines that do the repetitive parts for you, you will have real room to run here.
Responsibilities:
Platform & DevOps - the core of the job
Build, operate and troubleshoot CI/CD pipelines across multiple .NET services, Azure Functions and a React front end; keep daily pipeline health green and unblock failed builds fast.
Provision and manage Azure resources - App Service, Functions, Storage, Azure SQL, Service Bus, Redis, AI Search / Azure OpenAI, VMSS and container workloads - preferably through Infrastructure as Code.
Own environment configuration, service connections, agent pools, build/release branch policies and deployment approvals.
Manage identity and access: Entra ID app registrations, service principals, managed identities, RBAC, JIT/PIM elevation; review and clean up stale permissions on a schedule.
Rotate secrets and certificates on schedule; move credentials into Key Vault and eliminate local / shared-key auth.
Monitor platform health, availability and cost: Application Insights, Log Analytics / KQL, alert rules, budgets; respond to and drive incidents to resolution.
Support developers day to day - grant deployment permissions, provision resources, triage DevOps requests - and document runbooks, FAQs and technical guidance.
Plan and execute infrastructure lifecycle work: decommissioning, platform and runtime upgrades, migrations.
Security & compliance engineering - what makes this role different
Drive security action items to closure: CVE and dependency vulnerability remediation, OS and runtime patching, and cloud-security recommendations (target: secure score ≥ 95%).
Remediate static-analysis findings with the dev team - e.g. SSRF, disabled certificate validation, credential leaks - not just file them as bugs.
Harden cloud posture: disable public network access, enforce private endpoints and end-to-end TLS, disable local auth on PaaS resources, manage IP / service tags, apply least privilege.
Prepare and shepherd security design reviews and threat models for each product; run reviewer feedback rounds through to approval and keep due dates from slipping.
Run annual assessments - security, privacy, accessibility, business continuity / DR - and keep the service registry, asset inventory and subscription classification accurate.
Support Responsible AI reviews for AI features: document AI use cases and changes, coordinate harm testing (harmful content, jailbreak / prompt injection, groundedness), and record risks and mitigations.
Enforce supply-chain controls in release pipelines: SBOM generation, approved package feeds, production-branch change management, code signing and anti malware gates.
Report compliance status weekly to engineering and program management; forecast due dates, negotiate extensions and escalate blockers early.
Ways of working
Participate in sprint planning; break security and compliance findings into actionable stories and tasks in Azure DevOps.
Automate repetitive ops and compliance work with scripts, pipelines and AI / agent tooling. The team is moving from DevOps toward AIOps - our stated goal is for recurring SFI / S360 compliance tickets to be triaged, remediated and closed by agents, with humans only at approval gates. You will help build that.
Requirements:
Must have:
Bachelor's degree in Computer Science, Information Technology, Information Security or equivalent practical experience.
3+ years of DevOps experience is required - in a DevOps / Cloud Engineering / SRE / DevSecOps role, including hands-on Azure. Time spent purely in software development does not count toward this.
Ownership mindset
Comfortable being a single point of contact
Strong problem-solving, documentation and cross-team communication skills.
Azure, hands-on:
App Service, Azure Functions, Storage, Key Vault, Service Bus, Azure SQL, networking (VNet, Private Endpoint, NSG, firewall), Entra ID / RBAC / managed identity.
CI/CD:
strong Azure DevOps Pipelines (YAML); plus any of GitHub Actions, Jenkins, GitLab CI. Infrastructure as Code: Bicep, ARM templates or Terraform (Ansible a plus).
Containerization & orchestration:
Docker; Kubernetes / Helm fundamentals.
Scripting & automation:
PowerShell and/or Python, plus Bash. You must be able to write automation, not only click through portals.
Application security fundamentals:
OWASP Top 10, threat modeling (e.g. STRIDE), SAST / DAST / SCA concepts, CVE triage and patching, secrets management, least privilege.
Observability:
Application Insights, Log Analytics / KQL, alerting, basic incident response. Git and branch / release governance.
Working English
you will read Microsoft security standards, write status updates, and work directly with reviewers and program managers.
Nice-to-Have
AI & automation engineering
Microsoft internal tools
Benefits:
Salary at 100% during the probationary period.
90% contribution of the gross salary to social insurance.
20 days leave (12 days of annual leave and 8 days of sick leave).
Full working equipment will be provided.
Annual Health Checkup
Working location:
VISTA Building, 19 Tan Cang St., Ward 25, Binh Thanh Dist., HCM City
Working hour: Monday - Friday, 9AM - 6PM
Email contact: [protected info]