{"id":3749747,"url":"https://alion.io/job/base-vn-hnhcm-senior-security-engineer-secops-cloud-security","title":"[HN/HCM] Senior Security Engineer (SecOps Cloud Security)","company":{"id":49455,"name":"Base.vn","domain":"base.vn","url":"https://alion.io/company/base-vn","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Base","truth_index":{"grade":"A","score":100,"open_postings":8,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":54,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Hanoi, Vietnam"],"countries":["VN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"Cilium Tetragon","optional":false},{"name":"CIS Benchmarks","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"DNS","optional":false},{"name":"Elastic SIEM","optional":false},{"name":"ElasticSearch","optional":false},{"name":"Falco","optional":false},{"name":"GCP","optional":false},{"name":"Google GKE","optional":false},{"name":"Google SecOps","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Shuffle","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"SQL","optional":false},{"name":"TCP/IP","optional":false},{"name":"TheHive","optional":false},{"name":"Tines","optional":false},{"name":"VPN","optional":false},{"name":"Wazuh","optional":false},{"name":"MISP","optional":true},{"name":"OpenCTI","optional":true},{"name":"Prometheus","optional":true},{"name":"Velociraptor","optional":true}],"status":"live","first_seen_at":"2026-11-03T17:00:00Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-10T03:51:34Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"Base operates a large-scale, cloud-native business management platform, serving 12,000+ businesses and continuously evolving its technology infrastructure for the AI era.\nAs our platform grows, protecting our infrastructure, data, and internal systems becomes increasingly critical.\nAs a Senior Security Engineer (SecOps / Cloud Security), you will take ownership of building and strengthening Base's security operations and cloud infrastructure protection capabilities. You will design security monitoring and threat detection systems, secure our Google Cloud Platform (GCP) and Kubernetes environments, and lead incident response to ensure our systems remain resilient against evolving security threats.\nThis role goes beyond operating existing security tools. We are looking for an engineer who can build security capabilities from the ground up, identify weaknesses before they become incidents, and establish scalable security practices across our engineering organization.\nWHAT YOU DO\nBase builds a business management platform for Vietnamese companies, increasingly powered by AI. You will detect and respond to threats across our Google Cloud/GKE infrastructure and internal workplace, and help Base meet its security and data protection obligations.\nBuild Base's SOC from the ground up: define the operating model (scope, alert tiers, on-call, escalation to SRE and leadership), processes and KPIs (MTTD, MTTR, alert quality); decide what to build in-house and what to buy or outsource (MDR/MSSP).\nDesign and run the SIEM: onboard security log sources (GCP Cloud Audit Logs, VPC Flow Logs, Kubernetes audit logs, WAF/Cloud Armor, IdP/SSO, endpoints, CI/CD), normalize and retain them cost-effectively, building on our existing ELK/OpenObserve or a better-fitting platform.\nDetection engineering: write and maintain detection rules as code (Sigma or equivalent) mapped to MITRE ATT&CK, test them against simulated attacks, tune out false positives and track coverage.\nBuild SOAR and response automation: alert enrichment, triage, case management and automated containment (disable accounts, revoke keys, isolate workloads) with platforms such as Shuffle, Tines, Cortex XSOAR or TheHive, integrated with chat and ticketing.\nThreat intelligence and hunting: consume relevant threat intel feeds and IOCs; run regular threat hunts across cloud, Kubernetes and endpoint telemetry.\nManage cloud security posture: review GCP and GKE configuration against CIS Benchmarks and Security Command Center; track and close misconfigurations.\nOwn IAM policy: least privilege for people and service accounts, migration to Workload Identity, removal of static keys, periodic access reviews.\nSecure GKE at runtime: Pod Security Standards, NetworkPolicy, anomalous container behavior detection (Falco, Tetragon or similar).\nRun infrastructure vulnerability management: track CVEs for nodes, OS, images and open-source components; set remediation SLAs by severity and follow through to closure.\nRespond to security incidents: write playbooks, investigate, collect evidence, contain and recover; run tabletop exercises with SRE.\nProtect employee identities and endpoints: SSO/MFA, email security, device management, phishing awareness program.\nWHO YOU ARE\n5+ years in security, including at least 2 years in SOC, incident response or cloud security.\nHave built or significantly matured a SOC, SIEM or detection program, not only operated one.\nHands-on with at least one SIEM (Elastic Security, Splunk, Microsoft Sentinel, Google SecOps, Wazuh…) and one SOAR or response automation platform.\nStrong log analysis and fluent querying on at least one SIEM/log platform (Elasticsearch/Lucene, SQL, KQL, SPL…).\nHands-on experience with GCP or AWS security services: IAM, audit logs, KMS/Secret Manager, firewall/VPC.\nUnderstanding of Kubernetes security: RBAC, service accounts, pod security, network policy.\nSolid networking fundamentals: TCP/IP, DNS, TLS, firewalls, WAF, VPN.\nStrong Linux administration; scripting in Python or Bash to automate investigation and response.\nWorking knowledge of MITRE ATT&CK and the incident handling lifecycle (NIST SP 800-61 or equivalent).\nHave led security incidents or programs end to end and mentored other engineers.\nNice to have\nGoogle Professional Cloud Security Engineer, CKS, GCIH, GCIA, BTL1, OSCP.\nExperience with EDR/XDR and open-source SOC tooling (TheHive, MISP, Velociraptor, OpenCTI).\nProtected a multi-tenant SaaS holding personal data.\nWHAT YOU CAN GET\nBuild at Scale\nWork on security challenges within a large-scale, cloud-native SaaS platform serving 12,000+ businesses.\n\nTake ownership of building and shaping Base's Security Operations and Cloud Security capabilities.\n\nWork directly with SRE, Platform, and Product Engineering teams on real infrastructure and security challenges.\n\nAccelerate Your Career\nExpand your expertise across Cloud Security, Security Operations, Detection Engineering, and Incident Response.\n\nDevelop architectural thinking and technical ownership in a growing technology organization.Have opportunities to shape security standards, engineering practices, and long-term security strategy.\n\nHave opportunities to shape security standards, engineering practices, and long-term security strategy.\n\nCompensation & Benefits\nCompetitive compensation based on experience and technical capabilities.\n\nPerformance-based rewards and company benefits.\n\nOpportunities for continuous learning, professional development, and technical certifications.\n\nGET READY TO BE OUR SENIOR SECURITY ENGINEER\nIf you are passionate about building reliable systems, solving complex infrastructure challenges and improving the engineering foundations behind large-scale products, we would love to hear from you.\nHiring Process:\nRound 1: Technical Interview - Deep dive into your technical expertise, system design, infrastructure experience and problem-solving capabilities with the Engineering team.\n\nRound 2: Final Interview - Discussion with CEO about technical ownership, leadership capabilities and your potential contribution to Base.","description_format":"text","description_chars":6076,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Workflow & Process Automation (RPA, BPM)","Project & Work Management Software","HR & Payroll Software"],"lifecycle":[{"event":"open","at":"2026-11-04T14:44:44Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":5,"expected_fill_days":54,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-11-09T06:03:00Z"},"pay":null,"html_url":"https://alion.io/job/base-vn-hnhcm-senior-security-engineer-secops-cloud-security","json_url":"https://alion.io/job/base-vn-hnhcm-senior-security-engineer-secops-cloud-security.json","meta":{"generated_at":"2026-11-10T04:31:05Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10556,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":49455},"rest":"https://alion.io/mcp/rest/get_company?id=49455"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbase-vn-hnhcm-senior-security-engineer-secops-cloud-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbase-vn-hnhcm-senior-security-engineer-secops-cloud-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbase-vn-hnhcm-senior-security-engineer-secops-cloud-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/base-vn-hnhcm-senior-security-engineer-secops-cloud-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbase-vn-hnhcm-senior-security-engineer-secops-cloud-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3749747}},{"tool":"search_jobs","arguments":{"company":"base.vn","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3749747},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}