Location: Victory Tower, 318-320 Nguyen Oanh, Go Vap Ward, HCMC
Experience: Junior - Middle
Type: Full-time / Hybrid
Requirement:
Experience with one or more of:
• SIEM / Log Platforms (Splunk, Microsoft Sentinel, Elastic, OpenSearch, OpenObserve or equivalent)
• AWS GuardDuty, CloudTrail, Security Hub, Detective, WAF, VPC Flow Logs
• EDR / XDR (CrowdStrike, Microsoft Defender, SentinelOne or equivalent)
• IDS / IPS and Network Monitoring (Suricata, Zeek)
• Packet Analysis (Wireshark, tcpdump)
• SOAR / Automation Platforms
• Forensic Tooling (Velociraptor, KAPE, Volatility, Autopsy)
• Threat Intelligence Platforms (MISP or equivalent)
• Vulnerability Management and Scanning Tools
• Ticketing and Case Management (Jira, ServiceNow)
Preferred Qualifications
• Experience in a 24/7 SOC, MSSP or in-house security operations team.
• Hands-on experience responding to real security incidents end to end.
• Experience monitoring AWS-based SaaS platforms at scale.
• Experience with detection-as-code and detection engineering workflows.
• Experience building SOAR playbooks or SOC automation.
• Experience with threat hunting and purple-team exercises.
• Exposure to cloud incident response and container forensics
Security certifications such as BTL1, CySA+, GCIH, GCIA, GCFA, SC-200, Security+ or equivalent
Responsibility:
1. Security Monitoring: Continuously monitor production and corporate environments for abnormal behaviour and signs of attack. Monitored surfaces include:
• Web Applications and Public Endpoints
• REST / GraphQL APIs
• Authentication & SSO Systems
• AWS Cloud Control Plane
• Kubernetes & Container Workloads
• Networks, VPNs and Remote Access
• Endpoints and Servers
• Databases and Data Stores
• CI/CD Pipelines and Source Control
• Email and Collaboration Platforms
• Third-party and SaaS Integrations
2. Alert Triage & Investigation: Own the alert queue end to end and drive every alert to a documented outcome.
• Triage alerts from SIEM, EDR, WAF, cloud-native and application sources.
• Classify alerts as true positive, false positive or benign true positive.
• Enrich alerts with asset, identity, geolocation and threat-intelligence context.
• Determine scope, blast radius and affected assets or identities.
• Escalate confirmed incidents with a clear, evidence-backed handover.
• Meet agreed triage and escalation SLAs
• Ensure no alert is closed without a recorded rationale.
3. Threat Detection: Detect, investigate and characterise attacker activity, including:
Application & API Attacks
• Exploitation Attempts against Web Applications and APIs
• Vulnerability Scanning and Reconnaissance Activity
• Injection and Command Execution Attempts
• Path Traversal and File Upload Abuse
• Server-Side Request Forgery Attempts
• Broken Access Control and Enumeration Patterns
• API Abuse and Business Logic Abuse
• Rate Limit Bypass Attempts
• Suspicious Requests and Anomalous User Agents
• WAF Events
Identity & Access Attacks
• Brute-force Attacks
• Password Spraying
• Credential Stuffing
• MFA Fatigue and MFA Bypass Attempts
• Session Hijacking and Token Replay
• Impossible Travel and Anomalous Logins
• Suspicious IAM Activity
• Privilege Escalation Attempts
• New or Modified Access Keys and Long-lived Credentials
• Dormant Account Reactivation
Cloud & Infrastructure Attacks
• AWS GuardDuty Findings
• AWS CloudTrail Anomalies
• Cross-account Access Anomalies
• Security Group and Network ACL Changes
• Unexpected Resource Creation or Region Usage
• Exposed Secrets and Credential Leakage
• Public Exposure of Storage or Databases
• Kubernetes Audit Log Anomalies
• Container Escape and Runtime Anomalies
• Data Exfiltration and Unusual Egress Patterns
Endpoint & Malware Activity
• Malware and Ransomware Indicators
• Command-and-Control Beaconing
• Living-off-the-Land Binary Abuse
• Persistence Mechanisms
• Lateral Movement
• Suspicious Process, Script and PowerShell Execution
• EDR Detections and Tamper Attempts
Availability & Abuse
• DDoS / DoS Attempts
• Automated Bot Activity and Scraping
• Sudden Error Rate Increases
• Unusual CPU, Memory, Network or Application Workloads that may indicate attack or compromise
• Cryptomining and Resource Hijacking
4. Incident Response
Lead or support incident response through the full lifecycle, following NIST-aligned practice.
• Declare and classify incidents by severity.
• Perform containment, eradication and recovery actions with system owners.
• Coordinate response across Engineering, DevOps, IT and management.
• Maintain an accurate incident timeline and evidence chain.
• Preserve forensic artefacts before remediation destroys them.
• Produce incident reports and post-incident reviews.
• Track corrective and preventive actions to completion.
• Participate in on-call rotation for high-severity incidents.
5. Threat Hunting
Proactively search for malicious activity that existing detections did not catch.
• Form and test hypothesis-driven hunts against log and telemetry data.
• Hunt using MITRE ATT&CK techniques relevant to our stack.
• Hunt on indicators from threat intelligence and recent industry incidents.
• Identify dormant compromise, persistence and stale access.
• Convert every hunt outcome into a detection rule or a logging improvement.
• Document hunt scope, queries, findings and coverage.
6. Detection Engineering
Continuously improve detection quality and coverage — detection-as-code where possible.
• Develop and maintain detection rules, correlation logic and alerts.
• Tune noisy rules and systematically reduce false positives.
• Map detection coverage against MITRE ATT&CK and identify gaps.
• Version-control detection content and peer-review changes.
• Test detections against simulated attacker behaviour.
• Define alert severity, routing and escalation thresholds.
• Maintain detection documentation and expected response for each rule.
7. Log Management & Visibility
Ensure the SOC can actually see what it needs to see.
• Onboard new log sources into the SIEM / log platform.
• Normalise and parse log data into a consistent schema.
• Identify and close logging and telemetry blind spots.
• Monitor log pipeline health and alert on ingestion failures or silent sources.
• Validate log retention against operational and compliance needs.
• Balance visibility requirements against ingestion and storage cost.
8. Security Automation
Improve SOC efficiency through automation and AI-assisted analysis.
• Automate alert enrichment and context gathering.
• Automate repetitive triage and containment actions.
• Build and maintain SOAR playbooks.
• Develop internal scripts and tooling for investigation at scale.
• Automate reporting and SOC metrics collection.
• Utilise AI-assisted tooling for log analysis, alert summarisation and investigation support.
9. Threat Intelligence
Turn external threat information into internal detection and response value.
• Track newly published CVEs and active exploitation in the wild.
• Monitor emerging attack techniques and tooling.
• Ingest and operationalise indicators of compromise.
• Assess applicability of new threats to our products and infrastructure.
• Retro-hunt historical data for newly published indicators.
• Share actionable intelligence with Engineering and Product Security.
10. Digital Forensics
Perform forensic analysis to determine root cause and full extent of compromise.
• Acquire and preserve evidence from hosts, containers and cloud environments.
• Perform host, memory, log and network forensic analysis.
• Reconstruct attacker activity and timeline.
• Determine initial access vector and data impact.
• Maintain chain of custody and defensible documentation.
• Support legal, compliance or customer-notification requirements when required.
11. SOC Operations & Continuous Improvement: Keep the SOC itself running well and getting better.
• Maintain and improve incident runbooks and standard operating procedures.
• Ensure clean shift handover and queue continuity.
• Participate in purple-team and detection validation exercises with Product Security.
• Feed detection and logging gaps back to Engineering and DevOps.
• Recommend improvements to security controls and mitigation strategies.
• Mentor junior analysts and contribute to internal knowledge base.
12. Security Reporting: Produce and maintain:
• Incident Reports
• Post-Incident Reviews
• Investigation Notes and Timelines
• Threat Hunting Reports
• Detection Coverage Reports
• Threat Intelligence Briefs
• Daily / Weekly SOC Operational Reports
• SOC Metrics and Dashboards
• Executive Security Summaries
Benefits:
1. Compensation and benefit package
2. Exciting career and development opportunities
3. Friendly and English-speaking working environment
Senior Frontend (Vuejs)
Orange Uni
System Architect (strong in SAP S/4HANA)
Facade and Building Jobs
Sr. Software Engineer - Data Platform (Golang/Python)
Olik Global
Mainframe z/OS System Programmer
Zimaw LLC
1:1 Mentorship Program Lead
Indigo Research
Python Senior Developer - Data Analysis, SQL
Hcltech