{"id":3749749,"url":"https://alion.io/job/base-vn-hnhcm-senior-security-engineer-devsecops-application-security","title":"[HN/HCM] Senior Security Engineer (DevSecOps & Application Security)","company":{"id":49455,"name":"Base.vn","domain":"base.vn","url":"https://alion.io/company/base-vn","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Base","truth_index":{"grade":"A","score":100,"open_postings":8,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":54,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hanoi, Vietnam"],"countries":["VN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Burp Suite","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"External Secrets","optional":false},{"name":"Gitleaks","optional":false},{"name":"Google GKE","optional":false},{"name":"Kubernetes","optional":false},{"name":"Kyverno","optional":false},{"name":"npm","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"OWASP ZAP","optional":false},{"name":"Semgrep","optional":false},{"name":"SQL","optional":false},{"name":"CodeQL","optional":true},{"name":"GCP","optional":true},{"name":"JavaScript","optional":true},{"name":"Sigstore","optional":true},{"name":"SLSA","optional":true}],"status":"live","first_seen_at":"2026-11-03T17:00:00Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-08T10:01:48Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Base.vn is an AI-powered Enterprise Management Platform, founded in August 2016, and one of Vietnam's pioneering B2B SaaS companies.\nWe build a comprehensive platform that helps businesses streamline operations, improve productivity, and scale through technology. Today, Base supports over 12,000 businesses and serves more than 60 million pageviews every month.\nAs our platform evolves across a mature core system and a new generation of microservices, security is becoming a fundamental part of how we design, build, and operate software.\nWe are looking for a Senior Security Engineer to strengthen our application security and DevSecOps capabilities, embedding security throughout the software development lifecycle while enabling engineering teams to move fast and build with confidence.\nThis is not a traditional security operations role. You will work closely with Software Engineers, DevOps, and Product teams to identify risks, engineer practical security solutions, and establish security standards across our engineering ecosystem.\nWHAT YOU DO\nBase runs a mature core platform alongside a new generation of microservices, all shipped through automated CI/CD pipelines onto our cloud-native infrastructure. You will build security into that whole lifecycle, from feature design to what runs in production, in a way developers want to use rather than work around.\nThreat-model new features and services, focusing on SaaS-specific risks: tenant data isolation, multi-level authorization, file upload/viewing, SSO/OAuth, public APIs and webhooks.\nBuild security into CI/CD: SAST (e.g. Semgrep), SCA for Composer and npm, secret scanning (e.g. gitleaks), IaC and Kubernetes manifest scanning, container image scanning; gate by severity without slowing pipelines down.\nSecure the software supply chain: harden shared base images, SBOMs, image signing, admission policy on GKE (Kyverno, Gatekeeper or Binary Authorization).\nManage secrets: move secrets out of repos and config into Secret Manager/External Secrets; coordinate rotation after exposure.\nTest application security: security code review for high-risk changes, manual web/API/mobile pentesting, DAST (Burp Suite, OWASP ZAP); run a vulnerability disclosure or bug bounty channel.\nPartner with developers on remediation: concrete fix guidance, secure coding guidelines for the languages we use, OWASP Top 10 training, a security champions network across teams.\nTrack vulnerabilities in the frameworks and libraries we use; assess real-world impact and coordinate patching.\nWHO YOU ARE\n5+ years in software development or application security, including at least 2 years in AppSec; comfortable reading and reviewing application code in common web languages.\nDeep knowledge of the OWASP Top 10 and OWASP API Security Top 10; able to exploit and explain broken access control/IDOR, SQL injection, XSS, SSRF, deserialization, file upload flaws and authentication/session bugs.\nExperience configuring CI/CD pipelines and Docker; understand Kubernetes at the application deployment level.\nHave integrated at least one SAST, SCA or secret scanning tool into a real pipeline.\nCommunicate well with developers: explain risk in terms of concrete impact and propose practical fixes.\nHave owned an AppSec or DevSecOps program end to end and mentored developers or other engineers.\nNice to have\nOSWE, BSCP, OSCP, GWAPT, CKS.\nCVEs or bug bounty track record.\nWriting custom Semgrep/CodeQL rules; experience with SLSA, Sigstore.\nDeep understanding of OAuth 2.0/OIDC/SAML; Android/iOS mobile pentesting.\nAppSec for a multi-tenant SaaS or systems handling HR or financial data.\nWHAT YOU CAN GET\nBuild at Scale\nWork on a large-scale B2B SaaS platform serving 12,000+ businesses and 60+ million pageviews every month.\n\nSolve real-world security challenges across a mature core platform and a growing microservices ecosystem.\n\nHave direct ownership and influence over application security architecture, DevSecOps practices, and engineering security standards.\n\nBuild security solutions that directly impact the reliability, resilience, and trustworthiness of products used by thousands of businesses.\n\nAccelerate Your Career\nExpand your expertise across Application Security, DevSecOps, Cloud Security, and modern software architecture.\n\nWork alongside experienced Software Engineers, Platform Engineers, and Product teams in a highly technical environment.\n\nTake ownership of security initiatives from strategy and architecture to hands-on implementation.\n\nGrow into a technical leadership role, shaping security engineering practices and developing security capabilities across the organization.\n\nCompensation & Benefits\nCompetitive compensation based on experience and demonstrated capabilities.\n\nPerformance-based rewards and opportunities for long-term career growth.\n\nAccess to learning resources, technical training, and professional certification opportunities.\n\nA collaborative engineering environment that values ownership, continuous learning, and meaningful impact.\n\nGET READY TO BE OUR SENIOR SECURITY ENGINEER\nLet's build a more secure foundation for the next generation of enterprise software.\nHiring Process:\nRound 1: Technical Interview - Deep dive into your technical expertise\n\nRound 2: Final Interview - Discussion with CEO about technical ownership, leadership capabilities and your potential contribution to Base.","description_format":"text","description_chars":5377,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","DevSecOps","Workflow & Process Automation (RPA, BPM)","Project & Work Management Software"],"lifecycle":[{"event":"open","at":"2026-11-04T14:44:44Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":54,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-11-08T05:47:12Z"},"pay":null,"html_url":"https://alion.io/job/base-vn-hnhcm-senior-security-engineer-devsecops-application-security","json_url":"https://alion.io/job/base-vn-hnhcm-senior-security-engineer-devsecops-application-security.json","meta":{"generated_at":"2026-11-08T11:50:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":25335,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49455},"rest":"https://alion.io/mcp/rest/get_company?id=49455"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbase-vn-hnhcm-senior-security-engineer-devsecops-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbase-vn-hnhcm-senior-security-engineer-devsecops-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbase-vn-hnhcm-senior-security-engineer-devsecops-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/base-vn-hnhcm-senior-security-engineer-devsecops-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbase-vn-hnhcm-senior-security-engineer-devsecops-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3749749}},{"tool":"search_jobs","arguments":{"company":"base.vn","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3749749},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}