{"id":1323631,"url":"https://alion.io/job/concung-com-application-security-appsec-engineer","title":"Application Security (AppSec) Engineer","company":{"id":2799157,"name":"Concung.com","domain":"concung.com","url":"https://alion.io/company/concung","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ho Chi Minh City, Vietnam"],"countries":["VN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":37000,"max_usd":98000,"period":"year","method":null,"sample_n":2443},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Kubernetes","optional":true},{"name":"Terraform","optional":true}],"status":"live","first_seen_at":"2026-09-22T20:02:30Z","employer_posted_date":null,"last_verified_at":"2026-09-22T20:02:30Z","board_verified":false,"closed_at":null,"days_open":5,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":5},"description":"We are seeking an Application Security Engineer to build and develop our application security capability. The core mandate is security: defining how the organization designs, builds, and ships software securely — spanning secure SDLC, DevSecOps, security architecture and design, application security testing, and developer enablement. The engineer drives security into the development lifecycle and CI/CD pipelines and fundamentally reduces security risk in software.\nKey Responsibilities\nSecurity by Design: Threat modeling, secure design review, security requirements; collaborate with architects to embed security into application design.\nSecurity Architecture & Solutions: Recommend and implement security controls appropriate to each application's risk profile — e.g., WAF, API security, mobile app hardening (RASP / anti-tampering).\nApplication Security Testing: Operate SAST/DAST/SCA/SBOM tooling; triage findings, eliminate false positives, validate exploitability, and prioritize remediation by real risk.\nSecure SDLC & DevSecOps Integration: Embed security gates and automated checks into CI/CD pipelines.\nAppSec Maturity (OWASP SAMM): Run SAMM assessments, define the maturity roadmap, and measure improvement over time.\nDeveloper Enablement: Secure coding training và Security Champions program.\n\n Job Requirements\nWe are looking for a highly motivated person with:\n2-3+ years of experience with Application Security Engineering or related Security roles.\nSolid foundation in application security: OWASP Top 10 and beyond — common vulnerability classes, ability to read code and understand why a finding is (or isn't) exploitable.\nHands-on secure SDLC & secure design: threat modeling, secure design review, security requirements.\nStrong understanding of SAST, DAST, SCA and SBOM tooling — interpreting results, triaging false positives, prioritizing by risk.\nAbility to select the right tool for the right context (judgment, not tool-operation).\nWorking knowledge of CI/CD and automation as the delivery medium (Python/Bash).\nExcellent collaboration and communication skills, with the ability to work closely with developers, architects, and operations teams.\nA proactive attitude & the ability to think outside of the box\nWorks in an organised, structured manner\nCan do attitude, gets things done\nExcellent communication skills with diverse audiences\nStrong critical thinking and analytical skills\nNice-to-have:\nPractical OWASP SAMM (or BSIMM) implementation experience.\nSecurity architecture experience: WAF, API security, mobile app shielding/RASP.\nAwareness of secure-by-design frameworks/regulations: NIST SSDF, EU Cyber Resilience Act.\nA relevant AppSec/offensive cert (OSWE, eWPTX, GWAPT, Burp Suite Certified, CSSLP) — tín hiệu lọc nền tảng security.\nIaC security (Terraform/K8s/Helm), cloud security, English.\nBenefit\nAnnual bonus: 2 - 3 months under minimum KPI requirement\nFast promotion opportunities based on personal ability\nWork in a dynamic, open, creative environment\nRegular training, company team building, birthday bonus\nAbout Concung.com\nWorking time: 8:30 - 17:30 Monday - Friday\nWorking place: 6th Floor, 9 Nguyen Trai Street, Pham Ngu Lao Ward, District 1, Ho Chi Minh City\n\n Ngành nghề: CNTT - Phần mềm, CNTT - Phần cứng / Mạng, Bán lẻ / Bán sỉ\n\n Kinh nghiệm: 2 Năm\n\n Cấp bậc: Nhân viên\n\n Hình thức: Nhân viên chính thức\n\n Địa điểm: Hồ Chí Minh","description_format":"text","description_chars":3383,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security"],"lifecycle":[{"event":"open","at":"2026-09-27T00:12:37Z"}],"liveness":{"score":80,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.798,"p_room":1,"age_days":4,"expected_fill_days":21,"reasons":["seen:4","win:early"],"computed_at":"2026-09-27T05:45:00Z"},"pay":null,"html_url":"https://alion.io/job/concung-com-application-security-appsec-engineer","json_url":"https://alion.io/job/concung-com-application-security-appsec-engineer.json","meta":{"generated_at":"2026-09-28T03:21:02Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":2088,"day_limit":5000,"remaining_today":2912,"minute_limit":60,"resets_at":"2026-09-29T00:00:00Z"}}}