DevSecOps Engineer

Mô tả công việc
Mức độ phù hợp và xếp hạng của bạn so với ứng viên khác như thế nào?
ABOUT THE POSITION
The DevSecOps Engineer builds and operates the cloud infrastructure and delivery pipelines for the Center for AI Research's AI products on Vingroup's shared cloud and AI platform. The role manages environments, releases, monitoring and costs, and integrates security controls throughout development and deployment in line with Vingroup's processes. It also operates infrastructure supporting large language model (LLM) services, including model gateways, vector stores, tracing and cost controls. The engineer serves as the team's technical contact with VinSmart Future (VSF) on platform matters and with VinSOC on security reviews, scans and AI-risk assessments before and after go-live.
KEY RESPONSIBILITIES
1. Infrastructure & Delivery Pipeline
Cloud Infrastructure
• Design, build and maintain the products' AWS infrastructure across development, testing and production environments within Vingroup's shared cloud accounts and standards, using infrastructure-as-code and Kubernetes/Helm.
• Operate the databases, queues and caches the products depend on with appropriate high availability; implement backup, disaster recovery and failover testing.
CI/CD, GitOps & Change Management
• Design and operate CI/CD pipelines that automate build, test, security checks and deployment, using GitOps practices; execute releases and go-lives under a clear change-management process.
• Build tools for system analysis and automate repetitive operational work.
2. Security in the Pipeline
Security Controls
• Integrate security scanning into CI/CD - static and dynamic application testing, dependency and container scanning, software supply-chain checks - to identify and report security issues before deployment to production.
• Manage secrets, IAM and least-privilege access, network policies and secure configuration baselines (CIS, OWASP) across all environments.
Vulnerability & Data Protection
• Manage vulnerabilities and maintain a regular patching schedule for platform components; keep audit logging complete and reviewable.
• Apply personal-data protection requirements across all environments, including access controls and logging for learner, instructor and research data; coordinate security incident response with VinSOC.
3. Vingroup Compliance: VinSOC & VSF
VinSOC
• Act as the team's point of contact with VinSOC: submit systems and source code for review and receive periodic scan findings.
• Resolve configuration-related security issues, assign code-related issues to engineers, and ensure remediation is completed within deadlines based on severity.
VSF & Reviews
• Work with VSF on integration with Vingroup's shared AI platform and on the technical inputs for architecture, security and AI-risk reviews; coordinate independent penetration tests.
• Keep environments, configurations and integration points aligned with Vingroup's platform standards and shared components.
4. AI Platform Operations
LLM Infrastructure
• Operate the shared infrastructure for LLM-based services: model API gateways, per-user usage quotas, cost dashboards, and vector databases with backups.
• Manage model provider integrations to support switching or adding models with minimal changes to product code.
AI Data & Controls
• Maintain storage and versioning for model and prompt artifacts and evaluation datasets; keep evaluation and load-test pipelines running reliably for engineers.
• Maintain controls for model access, outbound data transfers and API key management, including redaction of personal data in traces and logs; support engineers in addressing AI-specific threats.
5. Operations, Reliability & Cost
Reliability & Observability
• Maintain observability systems for cloud infrastructure and LLM services, covering metrics, logs, traces and alerts using Prometheus, Grafana, ELK or equivalent tools; define and track service-level objectives.
• Respond to and resolve incidents, conduct root-cause analysis and implement preventive measures; build and run load and stress tests. Release and incident support outside office hours is occasionally required.
Cost, Documentation & Knowledge Sharing
• Optimize cloud and model costs, track usage and spending against budget, and coordinate release schedules with the Product Owner and operational readiness with engineers.
• Maintain runbooks, architecture diagrams, operational procedures and handover documentation; train another engineer to provide operational cover, and share platform and security practices through guides and internal sessions.