Cybersecurity Engineer (Security/API/Networking)

Security Monitoring & Operations

Monitor security for trading systems (OMS/Trading Core), partner API connections, online trading platforms, and mobile applications.
Continuously monitor systems through IDS/IPS, SIEM, and other security tools.
Manage, configure, and upgrade security and network devices, including NGFW firewalls, VPN, switches, and anti- DDoS systems.
Detect and respond to security incidents: malware, brute force attacks, DDoS, phishing, web attacks, and transaction anomalies.

Risk Assessment & Control

Conduct security risk assessments for new systems and IT projects.
Track, analyze, and remediate vulnerabilities (CVE, Zero- day).
Review and assess cloud infrastructure security.
Coordinate with external vendors to perform penetration testing and vulnerability assessments.

Regulatory Compliance & Audit

Ensure compliance with regulations, including Circular 13/2022/TT- BTC and requirements from SSC, Stock Exchanges, and VSD.
Maintain alignment with standards such as ISO 27001 and SOC 2.
Develop and update Information Security (IS) procedures: access management, risk management, incident response, backup, and disaster recovery.

Access & Privilege Management

Implement and manage MFA and privileged account management (PAM).
Perform periodic access reviews and user attestation.
Manage system access rights across the domain, CRM, email, databases, and trading systems.

Incident Response

Execute incident response procedures and conduct root cause analysis (RCA).
Report incidents to SSC/HOSE/VSD when trading activities are affected.

Security Awareness

Conduct internal security awareness training on anti- phishing, email safety, and risk identification.

Strong knowledge of Cybersecurity, IT Risk Management, and Internal Controls.
Good understanding of Web/App Security (OWASP Top 10) and API Security.
Experience with Linux/Windows servers, database security (Oracle/MS SQL/PostgreSQL), and networking (TCP/IP, routing, VLAN…).
Penetration testing experience is an advantage.
Proficient with core security tools: Firewall, IDS/IPS, WAF, SIEM, DLP/DDP, VPN.
Understanding of securities system architecture (OMS, trading core, clearing & settlement).
Preferred Certifications: CEH/OSCP/Security+/CySA+.
Soft skills: Analytical thinking, fast incident response, good documentation skills, and effective communication.
Languages: Good at English.

KPI bonus based on work results.
Lunch allowance, parking allowance, phone allowance, and other types of allowances, depending on job position.
Opportunities to participate in professional and career skill training programs organized by the company.
Leave policy:12 days/year for staff- level positions.15 days/year for managerial positions.
Participation in sports, entertainment, and travel activities such as team connection events, birthday celebrations, team- building, holiday gifts, etc., to promote health and strengthen employee engagement.
Financial support for attending external training programs.
Annual health check- ups, 24/24 accident insurance (health insurance), and social insurance with 100% of the salary package. Private health insurance is provided by PJICO.
Salary review 1–2 times per year.
Competitive salary based on capabilities.

Cập nhật gần nhất lúc: 2025-12-14 07:35:02