(Hanoi) Senior/Intermediate DevSecOps Engineer

About Us
Crossian is a high-growth technology-driven e-commerce business. As a start-up formed in 2020, we have created a fast-paced and dynamic environment, enabling our people to reach a cumulative average growth rate of over 1000% in the last 5 years.
Job Description
We are seeking a talented DevSecOps Engineer to join our team. In this role, you'll bridge the gap between development, operations, and security, ensuring our systems and applications are robust, scalable, and secure from day one.
You'll automate security checks, develop secure CI/CD pipelines, and foster a culture of collaboration and continuous improvement. Beyond core DevSecOps work, you'll help build our DevOps-as-a-Service (DaaS) platform - a multi-agent AI system that automates key parts of our DevOps workflow.
Responsibilities
Secure Delivery & Infrastructure
Design, build, and maintain secure CI/CD pipelines (GitLab CI, GitHub Actions) with automated security gates (SAST, DAST, secret scanning, dependency scanning) that block releases on critical findings.
Integrate security best practices into DevOps workflows and GitOps-based delivery (ArgoCD).
Collaborate with developers, operations, and security teams to design and implement secure infrastructure.
Maintain and enhance infrastructure as code (Terraform, Ansible, etc.), with policy checks before changes are applied.
Implement and manage container security on Docker and Kubernetes (EKS), including image scanning, Pod Security Standards, and network policies.
Identity, Secrets & Cloud Security
Manage secrets end-to-end with HashiCorp Vault / AWS Secrets Manager: rotation, no hard-coded credentials, and controlled injection into workloads.
Enforce IAM least privilege: role-based access, a dedicated identity per workload (IRSA / EKS Pod Identity), and regular access reviews.
Monitor and improve cloud security posture using AWS GuardDuty, Security Hub, Config, and CloudTrail.
Observability, SRE & Incident Response
Build and operate observability across metrics, logs, and alerting (Prometheus, Grafana, ELK / Kibana), keeping alerts actionable.
Define and track SLOs/SLIs, take part in on-call, and lead blameless postmortems.
Monitor systems for security breaches, respond to incidents, and drive vulnerability management and remediation.
AI & DevOps-as-a-Service (DaaS)
Work with the team to build DaaS, a shared multi-agent platform that automates DevOps workflows. Agents investigate, triage, and propose changes, while humans review and approve every change before it reaches production.
SRE / Incident investigation:
agents triggered by alerts or Slack investigate incidents across metrics, logs, and event streams, return a root-cause analysis with every finding cited to its source, and propose fixes as merge requests.
Request handling & service delivery:
turn developer requests from Slack or a self-service portal into golden-path services and GitOps configuration, delivered as merge requests for review.
Security finding triage:
triage and prioritise findings from scanners and cloud security tools, attach evidence, and propose remediations.
Second Brain:
a knowledge layer over services, repositories, wiki, and runbooks that answers questions about our infrastructure with source and freshness attached, for both engineers and agents.
Agent safety & governance:
build the guardrails that make agents safe near production, including allow-listed tool access, credential isolation from the agent layer, human-in-the-loop approvals, full audit trails, per-run cost budgets, and prompt-injection defenses.
Agent quality & LLMOps:
maintain evaluation sets that gate agent releases in CI, and operate the model gateway and LLM observability stack (LiteLLM, Langfuse).
General
Stay up to date with security threats, vulnerabilities, and technology trends, including AI-specific risks.
Educate and mentor teams on secure coding and DevSecOps principles.
Requirements
Bachelor's degree in Computer Science, Information Security, or related field, or equivalent experience.
3+ years of experience in DevOps (Intermediate), 5+ years (Senior).
Hands-on experience with AWS (EKS, IAM, networking) or a similar cloud.
Expertise in CI/CD tools (GitLab CI, GitHub Actions, Jenkins).
Strong Python skills; Bash scripting.
Experience with Docker and Kubernetes in production.
Experience with infrastructure as code (Terraform, Ansible, or similar).
Experience with DevSecOps security toolchains (SAST, DAST, SonarQube, dependency and image scanning) and server hardening.
Experience with secrets management and IAM least-privilege design.
Experience in vulnerability management and incident response.
Hands-on experience using LLMs in real projects (APIs, prompt engineering, tool calling).
Strong problem-solving, communication, and collaboration skills, with a proactive, continuously learning mindset.
Preferred Qualifications
Professional certifications (AWS, CKA / CKS).
Experience with GitOps (ArgoCD) and observability tooling (Prometheus, Grafana, ELK).
Experience building LLM agents or multi-agent systems (LangGraph, LangChain, or similar), MCP, and agent evaluation.
Familiarity with LLM gateways and observability (LiteLLM, Langfuse).
Knowledge of AI security risks (OWASP Top 10 for LLM Applications).
Knowledge of compliance frameworks (PCI DSS, ISO 27001, ISO/IEC 27018, GDPR).
What We Offer
Competitive salary and benefits.
Flexible work environment.
Opportunities for professional growth and training.
Collaborative team culture.
The chance to make a meaningful impact on our products and security posture.