[HN/HCM] Senior Security Engineer (DevSecOps & Application Security)

Base.vn is an AI-powered Enterprise Management Platform, founded in August 2016, and one of Vietnam's pioneering B2B SaaS companies.

We build a comprehensive platform that helps businesses streamline operations, improve productivity, and scale through technology. Today, Base supports over 12,000 businesses and serves more than 60 million pageviews every month.

As our platform evolves across a mature core system and a new generation of microservices, security is becoming a fundamental part of how we design, build, and operate software.

We are looking for a Senior Security Engineer to strengthen our application security and DevSecOps capabilities, embedding security throughout the software development lifecycle while enabling engineering teams to move fast and build with confidence.

This is not a traditional security operations role. You will work closely with Software Engineers, DevOps, and Product teams to identify risks, engineer practical security solutions, and establish security standards across our engineering ecosystem.

WHAT YOU DO

Base runs a mature core platform alongside a new generation of microservices, all shipped through automated CI/CD pipelines onto our cloud-native infrastructure. You will build security into that whole lifecycle, from feature design to what runs in production, in a way developers want to use rather than work around.

• Threat-model new features and services, focusing on SaaS-specific risks: tenant data isolation, multi-level authorization, file upload/viewing, SSO/OAuth, public APIs and webhooks.
• Build security into CI/CD: SAST (e.g. Semgrep), SCA for Composer and npm, secret scanning (e.g. gitleaks), IaC and Kubernetes manifest scanning, container image scanning; gate by severity without slowing pipelines down.
• Secure the software supply chain: harden shared base images, SBOMs, image signing, admission policy on GKE (Kyverno, Gatekeeper or Binary Authorization).
• Manage secrets: move secrets out of repos and config into Secret Manager/External Secrets; coordinate rotation after exposure.
• Test application security: security code review for high-risk changes, manual web/API/mobile pentesting, DAST (Burp Suite, OWASP ZAP); run a vulnerability disclosure or bug bounty channel.
• Partner with developers on remediation: concrete fix guidance, secure coding guidelines for the languages we use, OWASP Top 10 training, a security champions network across teams.
• Track vulnerabilities in the frameworks and libraries we use; assess real-world impact and coordinate patching.

WHO YOU ARE

• 5+ years in software development or application security, including at least 2 years in AppSec; comfortable reading and reviewing application code in common web languages.
• Deep knowledge of the OWASP Top 10 and OWASP API Security Top 10; able to exploit and explain broken access control/IDOR, SQL injection, XSS, SSRF, deserialization, file upload flaws and authentication/session bugs.
• Experience configuring CI/CD pipelines and Docker; understand Kubernetes at the application deployment level.
• Have integrated at least one SAST, SCA or secret scanning tool into a real pipeline.
• Communicate well with developers: explain risk in terms of concrete impact and propose practical fixes.
• Have owned an AppSec or DevSecOps program end to end and mentored developers or other engineers.

Nice to have

• OSWE, BSCP, OSCP, GWAPT, CKS.
• CVEs or bug bounty track record.
• Writing custom Semgrep/CodeQL rules; experience with SLSA, Sigstore.
• Deep understanding of OAuth 2.0/OIDC/SAML; Android/iOS mobile pentesting.
• AppSec for a multi-tenant SaaS or systems handling HR or financial data.

WHAT YOU CAN GET

Build at Scale

• Work on a large-scale B2B SaaS platform serving 12,000+ businesses and 60+ million pageviews every month.

• Solve real-world security challenges across a mature core platform and a growing microservices ecosystem.

• Have direct ownership and influence over application security architecture, DevSecOps practices, and engineering security standards.

• Build security solutions that directly impact the reliability, resilience, and trustworthiness of products used by thousands of businesses.

Accelerate Your Career

• Expand your expertise across Application Security, DevSecOps, Cloud Security, and modern software architecture.

• Work alongside experienced Software Engineers, Platform Engineers, and Product teams in a highly technical environment.

• Take ownership of security initiatives from strategy and architecture to hands-on implementation.

• Grow into a technical leadership role, shaping security engineering practices and developing security capabilities across the organization.

Compensation & Benefits

• Competitive compensation based on experience and demonstrated capabilities.

• Performance-based rewards and opportunities for long-term career growth.

• Access to learning resources, technical training, and professional certification opportunities.

• A collaborative engineering environment that values ownership, continuous learning, and meaningful impact.

GET READY TO BE OUR SENIOR SECURITY ENGINEER

Let's build a more secure foundation for the next generation of enterprise software.

Hiring Process:

• Round 1: Technical Interview - Deep dive into your technical expertise

• Round 2: Final Interview - Discussion with CEO about technical ownership, leadership capabilities and your potential contribution to Base.