[HN/HCM] Senior Security Engineer (SecOps Cloud Security)

Base operates a large-scale, cloud-native business management platform, serving 12,000+ businesses and continuously evolving its technology infrastructure for the AI era.

As our platform grows, protecting our infrastructure, data, and internal systems becomes increasingly critical.

As a Senior Security Engineer (SecOps / Cloud Security), you will take ownership of building and strengthening Base's security operations and cloud infrastructure protection capabilities. You will design security monitoring and threat detection systems, secure our Google Cloud Platform (GCP) and Kubernetes environments, and lead incident response to ensure our systems remain resilient against evolving security threats.

This role goes beyond operating existing security tools. We are looking for an engineer who can build security capabilities from the ground up, identify weaknesses before they become incidents, and establish scalable security practices across our engineering organization.

WHAT YOU DO

Base builds a business management platform for Vietnamese companies, increasingly powered by AI. You will detect and respond to threats across our Google Cloud/GKE infrastructure and internal workplace, and help Base meet its security and data protection obligations.

• Build Base's SOC from the ground up: define the operating model (scope, alert tiers, on-call, escalation to SRE and leadership), processes and KPIs (MTTD, MTTR, alert quality); decide what to build in-house and what to buy or outsource (MDR/MSSP).
• Design and run the SIEM: onboard security log sources (GCP Cloud Audit Logs, VPC Flow Logs, Kubernetes audit logs, WAF/Cloud Armor, IdP/SSO, endpoints, CI/CD), normalize and retain them cost-effectively, building on our existing ELK/OpenObserve or a better-fitting platform.
• Detection engineering: write and maintain detection rules as code (Sigma or equivalent) mapped to MITRE ATT&CK, test them against simulated attacks, tune out false positives and track coverage.
• Build SOAR and response automation: alert enrichment, triage, case management and automated containment (disable accounts, revoke keys, isolate workloads) with platforms such as Shuffle, Tines, Cortex XSOAR or TheHive, integrated with chat and ticketing.
• Threat intelligence and hunting: consume relevant threat intel feeds and IOCs; run regular threat hunts across cloud, Kubernetes and endpoint telemetry.
• Manage cloud security posture: review GCP and GKE configuration against CIS Benchmarks and Security Command Center; track and close misconfigurations.
• Own IAM policy: least privilege for people and service accounts, migration to Workload Identity, removal of static keys, periodic access reviews.
• Secure GKE at runtime: Pod Security Standards, NetworkPolicy, anomalous container behavior detection (Falco, Tetragon or similar).
• Run infrastructure vulnerability management: track CVEs for nodes, OS, images and open-source components; set remediation SLAs by severity and follow through to closure.
• Respond to security incidents: write playbooks, investigate, collect evidence, contain and recover; run tabletop exercises with SRE.
• Protect employee identities and endpoints: SSO/MFA, email security, device management, phishing awareness program.

WHO YOU ARE

• 5+ years in security, including at least 2 years in SOC, incident response or cloud security.
• Have built or significantly matured a SOC, SIEM or detection program, not only operated one.
• Hands-on with at least one SIEM (Elastic Security, Splunk, Microsoft Sentinel, Google SecOps, Wazuh…) and one SOAR or response automation platform.
• Strong log analysis and fluent querying on at least one SIEM/log platform (Elasticsearch/Lucene, SQL, KQL, SPL…).
• Hands-on experience with GCP or AWS security services: IAM, audit logs, KMS/Secret Manager, firewall/VPC.
• Understanding of Kubernetes security: RBAC, service accounts, pod security, network policy.
• Solid networking fundamentals: TCP/IP, DNS, TLS, firewalls, WAF, VPN.
• Strong Linux administration; scripting in Python or Bash to automate investigation and response.
• Working knowledge of MITRE ATT&CK and the incident handling lifecycle (NIST SP 800-61 or equivalent).
• Have led security incidents or programs end to end and mentored other engineers.

Nice to have

• Google Professional Cloud Security Engineer, CKS, GCIH, GCIA, BTL1, OSCP.
• Experience with EDR/XDR and open-source SOC tooling (TheHive, MISP, Velociraptor, OpenCTI).
• Protected a multi-tenant SaaS holding personal data.

WHAT YOU CAN GET

Build at Scale

• Work on security challenges within a large-scale, cloud-native SaaS platform serving 12,000+ businesses.

• Take ownership of building and shaping Base's Security Operations and Cloud Security capabilities.

• Work directly with SRE, Platform, and Product Engineering teams on real infrastructure and security challenges.

Accelerate Your Career

• Expand your expertise across Cloud Security, Security Operations, Detection Engineering, and Incident Response.

• Develop architectural thinking and technical ownership in a growing technology organization.Have opportunities to shape security standards, engineering practices, and long-term security strategy.

• Have opportunities to shape security standards, engineering practices, and long-term security strategy.

Compensation & Benefits

• Competitive compensation based on experience and technical capabilities.

• Performance-based rewards and company benefits.

• Opportunities for continuous learning, professional development, and technical certifications.

GET READY TO BE OUR SENIOR SECURITY ENGINEER

If you are passionate about building reliable systems, solving complex infrastructure challenges and improving the engineering foundations behind large-scale products, we would love to hear from you.

Hiring Process:

• Round 1: Technical Interview - Deep dive into your technical expertise, system design, infrastructure experience and problem-solving capabilities with the Engineering team.

• Round 2: Final Interview - Discussion with CEO about technical ownership, leadership capabilities and your potential contribution to Base.