DevSecOps Engineer (AWS, fluent English)

NSC Software delivers premier software development and consulting services for global businesses, powered by Vietnam’s top engineering talent. With a team of 200+ IT professionals, we continuously expand our capabilities, refine our delivery processes, and adopt cutting-edge technologies to meet diverse client needs.

Guided by our core values - Premier, Talented, Innovative, Committed, Trusted and Transparent - we focus on building long-term partnerships and delivering future-ready solutions. Through this, we aim to advance Vietnam’s IT industry and create meaningful global impact.

• Remote work, flexible working environment
• Attractive salary package
• Technical training and certifications
• Global career opportunities
• Enhance autonomy and independence

As a Senior DevSecOps Engineer at NSC, you will have the opportunity to work remotely, with fixed working hours from 7AM to 4PM Vietnam time.

We are looking for a DevSecOps Engineer to join the DevOps team of an Australian software company that builds an AI chat interview product for hiring. Job candidates and large employers trust this company with their data, and the company holds ISO 27001, SOC 2, and ISO 42001.

You will make security part of how the team builds software: closing audit findings, hardening the cloud, testing the company’s own defences, and making the secure way the easy way for every engineer. You will report to the Principal DevOps and MLOps Engineer and work closely with the Head of Governance, Risk and Compliance, in a 100% remote engineering team working in English.

• Run security operations and compliance: own security findings from audits, customer security reviews, and compliance monitoring until each is closed with evidence; monitor and respond to alerts from threat detection, vulnerability scans, the web application firewall, and audit logs; keep the company audit-ready at all times.
• Build security infrastructure as code: build and operate firewall rules, container and code scans, and security logging and alerting; harden a multi-account AWS environment (TLS, encryption, secrets management, least-privilege access).
• Test defences and fix vulnerabilities: run internal penetration tests and threat modelling on applications, APIs, and cloud; manage external penetration tests from scope to report; move engineering teams to fix vulnerabilities on time and automate the workflow from detection to verified fix.
• Own access management: manage access to internal systems (VPN, cloud accounts, databases, source control, AI tools), including joiner/mover/leaver steps and periodic access reviews; apply the company’s AI governance policy when assessing new tools and integrations.
• Improve developer experience: improve developer tooling, local environments, CI/CD, and onboarding so the secure way to build is also the easiest.
• Keep the platform healthy: handle patches, automatic dependency updates, and library and runtime upgrades, and work with engineers to repair what breaks.

• 5+ years in DevOps, platform engineering, SRE, or security engineering, including 1+ year in a role where security was the main work.
• Deep hands-on AWS security experience: IAM and Identity Center, VPC, WAF, GuardDuty, Inspector, CloudTrail, KMS, and Secrets Manager.
• Terraform in production.
• Containers (Docker with ECS or Kubernetes) and a CI/CD platform such as GitHub Actions or Buildkite.
• Vulnerability management in practice: CVE assessment, scanner triage, safe patching, and dependency upgrades.
• Application security: OWASP Top 10 and hands-on use of Burp Suite, OWASP ZAP, or a similar tool.
• A real example from your own work: a vulnerability or misconfiguration you found in production, how you found and confirmed it, and how you fixed it.
• Ability to explain findings clearly to both engineers and auditors, and to move a team to fix them.
• Comfortable working with controlled access and separation of duties (for example, access changes as code with a second approver, time-limited access, no permanent admin rights in production).
• Experience working in English with a foreign client, auditor, or remote team.
• Daily use of AI tools, with the judgment to check their output and keep sensitive data out of prompts.
• A valid passport and the ability to stay in Australia for about 1 month for workshops if necessary.

• Support for SOC 2, ISO 27001, or customer audits, ideally with Vanta or Drata (a strong advantage).
• Knowledge of ISO 42001, the standard for AI management systems.
• Security of AI and LLM systems: AWS Bedrock, guardrails, and protection against prompt injection.
• Identity administration: SSO and SAML, Okta, or Google Workspace.
• Security certifications such as AWS Certified Security Specialty or OSCP. Certifications are not required: the team tests knowledge, not certificates.

• Competitive salary of up to 2300 - 2500 USD per month (negotiable).
• Attractive Benefits: social insurance, private healthcare insurance, quarterly bonding, summer trip, company trip.
• Remote work arrangement, allowing for flexibility and comfort.
• Chance to enhance English language skills through interaction with native speakers.
• Opportunity to work within a professional and multicultural environment.