Header Section
Viettel Enterprise Solutions General Company (VTS) is a subsidiary unit of Viettel Industrial - Telecommunications Group, established with the mission to accompany the Government in successfully building a "Creative Government – Digital Government", cooperating with enterprises and citizens to solve social problems and bring better lives to everyone. Viettel Enterprise Solutions General Company currently has a Research and Development Center that masters new technologies of the 4.0 industrial revolution (Big Data, AI, IoT, AR/VR, Cloud, Blockchain...) delivering solutions for smart cities and digital transformation for enterprises, government, and organizations with directions such as connectivity, sharing and customer experience.
Brief Description
1. General Information
* Position: Information Security Assessment and Evaluation Specialist - Applications.
* Department: Information Security Department/Center / Information Technology Division
2. Job Objective
Responsible for conducting penetration testing, assessing security vulnerabilities and comprehensive control throughout the software development cycle (DevSecOps/SDLC). Ensure that applications (Web, Mobile, API, Internal Systems) before go-live and during operation comply with security standards, maximize prevention of attack risks and data leakage.
3. Main Tasks and Responsibilities
Information Security Assessment and Testing (Pentest & Assessment)
* Lead the implementation of penetration testing (Black-box, Gray-box, White-box) on Web applications, Mobile Apps (iOS/Android), API/Web Services and microservices systems.
* Conduct source code review/SAST to detect early business logic vulnerabilities and system architecture issues.
* Assess information security configuration of application infrastructure (Container, Kubernetes, Cloud Services if relevant).
DevSecOps Process Integration
* Participate in building, establishing and optimizing automated scanning tools (SAST, DAST, SCA) into CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions...).
* Coordinate with Software Development teams (Developers) and Architects to advise on remediation solutions for security vulnerabilities after assessment.
Building Standards & Compliance Monitoring
* Research, update new attack trends and develop assessment standards, checklists for application information security based on international frameworks (OWASP Top 10, ASVS, SANS...).
* Participate in reviewing and assessing information security for technical solutions, software from external partners or contractors (Supply Chain Security).
* Prepare detailed technical reports on detected vulnerabilities and comprehensive risk reports for management.
Requirements
* Education: Bachelor's degree with Good grade or higher in IT, Information Security, Electronics and Telecommunications or related fields.
* Experience: Minimum 2 - 5 years of practical experience in application Pentest or Information Security Assessment of software systems (depending on recruitment level). English 650 TOEIC or equivalent certificates.
Professional Knowledge & Technical Skills
* Core knowledge: Clear understanding of common security vulnerabilities (OWASP Top 10, CWE/SANS Top 25) and exploitation/prevention methods.
* Source code skills: Ability to read and understand source code of at least one of the common programming languages: Java, .NET, Python, Go, Node.js.
* Tool proficiency: Proficient use of specialized assessment tools (Burp Suite Pro, Acunetix, Fortify, SonarQube, Checkmarx, Kali Linux, SQLmap...).
* Operating Systems & Network: Deep understanding of operating system architecture (Linux/Windows), network protocols (TCP/IP, HTTP/HTTPS) and authentication mechanisms (OAuth2, JWT, SAML).
Professional Certifications (Preferred)
* Possession of reputable certifications in application testing/security is a major advantage: OSCP, OSWE, CEH Master, GWAPT, CISSP..