Lead - Cloud Security Engineer

MoMo processes billions of transactions each year for more than tens of millions of users across payments, lending, insurance, and investment products — all running on a multi-cloud platform spanning AWS, GCP, Azure, FPT Cloud, and VNG Cloud. As a Cloud Security Engineer, you will be the dedicated security practitioner who hardens our cloud and container estate end-to-end: from workload identity and network segmentation in Kubernetes, to supply-chain integrity in CI/CD, to runtime threat detection in production. You will work closely with platform, DevOps, data, and AI engineering teams to harden security by design — embedding guardrails directly into Terraform modules, Helm charts, and deployment pipelines so that secure-by-default is the easy path, not the slow one. Mô tả công việc▸ Harden Kubernetes — enforce workload identity, network policies, Pod Security Standards, RBAC, and admission control (OPA / Kyverno) across production and staging clusters.▸ Secure the software supply chain — implement container image scanning, signing (cosign / Notation), SBOM generation, secret scanning, and automated security gates in CI/CD pipelines.▸ Own cloud IAM secrets management — design and enforce least-privilege IAM across AWS, GCP, FPT Cloud, and VNG Cloud; manage secrets at scale with HashiCorp Vault / SOPS including automated rotation and periodic access reviews.▸ Isolate multi-tenant workloads — architect security boundaries for user-run Jupyter notebooks, Apache Spark jobs, and GPU workloads that execute arbitrary code on shared infrastructure.▸ Shift security left — codify secure-by-default Terraform modules, Helm charts, and pipeline templates so engineering squads get guardrails instead of gates.▸ Build detection response — deploy and tune runtime threat detection (Falco / Tetragon), cloud-native posture management (GCP SCC), centralize audit logs to SIEM, and author incident runbooks.▸ Govern AI data access — protect the LLM gateway and feature stores, define access policies for AI model endpoints, and support PCI-DSS Level 1 and BSP / SBV regulatory compliance. Yêu cầu công việc▸ Harden Kubernetes — enforce workload identity, network policies, Pod Security Standards, RBAC, and admission control (OPA / Kyverno) across production and staging clusters.▸ Secure the software supply chain — implement container image scanning, signing (cosign / Notation), SBOM generation, secret scanning, and automated security gates in CI/CD pipelines.▸ Own cloud IAM secrets management — design and enforce least-privilege IAM across AWS, GCP, FPT Cloud, and VNG Cloud; manage secrets at scale with HashiCorp Vault / SOPS including automated rotation and periodic access reviews.▸ Isolate multi-tenant workloads — architect security boundaries for user-run Jupyter notebooks, Apache Spark jobs, and GPU workloads that execute arbitrary code on shared infrastructure.▸ Shift security left — codify secure-by-default Terraform modules, Helm charts, and pipeline templates so engineering squads get guardrails instead of gates.▸ Build detection response — deploy and tune runtime threat detection (Falco / Tetragon), cloud-native posture management (GCP SCC), centralize audit logs to SIEM, and author incident runbooks.▸ Govern AI data access — protect the LLM gateway and feature stores, define access policies for AI model endpoints, and support PCI-DSS Level 1 and BSP / SBV regulatory compliance. Nice to have:▸ Experience with financial-services or fintech security requirements (PCI-DSS, data residency, fraud controls).▸ Familiarity with AI/ML platform security — model serving, feature stores, prompt-injection defenses, data access governance.▸ Relevant certifications: CKS, CCSP, GCP Professional Cloud Security Engineer, or AWS Security Specialty.▸ Exposure to runtime observability stacks (Falco, Tetragon, eBPF-based tooling) or CSPM/CNAPP platforms.