Cloud Securities Engineer

**Cloud Security Engineer (AWS / GCP / Multi-Cloud) — Hanoi / Ho Chi Minh City**

**About the role**

VinSmart Future runs multi-cloud infrastructure on AWS, Google Cloud (GCP) and Huawei Cloud, serving products for both domestic and global markets. We are hiring

**3 Cloud Security Engineers**

for our Security Engineering team. The team owns infrastructure security: Cloud Security Posture Management (CSPM), IAM governance, network security and cloud incident response.

You will work hands-on with DevOps to fix real security findings, build security controls as code and protect cloud workloads on Kubernetes and serverless platforms.

**What you'll do**

*Vulnerability remediation with DevOps*

• Work with DevOps engineers to find the root cause of each security finding, measure its impact and plan the fix for each environment.
• Make the technical changes yourself: IAM policies, Security Groups, S3 bucket policies, Network ACLs, Kubernetes RBAC and Terraform modules.
• Check that each fix works on staging and production, and close every finding with technical evidence.
• Review and harden Dockerfiles, GitLab CI/CD pipelines and Jenkins Shared Libraries (secrets management, container image signing, least-privilege execution).

*Multi-cloud security assessments*

• Run regular cloud security assessments against CIS Benchmarks, the AWS Well-Architected Security Pillar, GCP Security Foundations and Huawei Cloud security best practices.
• Audit IAM: excessive permissions, cross-account trust relationships, service account key exposure and privilege escalation paths.

*DevSecOps automation & Policy-as-Code*

• Build preventive guardrails as code: AWS Service Control Policies (SCPs), GCP Organization Policies and Huawei Cloud Config rules.
• Build automated detective controls with OPA/Rego, AWS Config custom rules and Security Command Center custom modules, so drift from the baseline is caught as soon as it appears.
• Maintain cloud security dashboards and alert thresholds for AWS Security Hub, Amazon GuardDuty, GCP Security Command Center and CSPM findings.

*Threat detection & incident response*

• Investigate alerts from Amazon GuardDuty, GCP Security Command Center and other detection tools.
• Join cloud incident response: log analysis, lateral movement tracing, blast radius assessment and containment.

*Security governance & documentation*

• Write and update cloud security architecture docs, incident response runbooks and secure configuration baselines.
• Run threat modeling for new systems and major architecture changes (managed services, serverless, container platforms).
• Send regular cloud security posture reports to the Security Engineering Lead and stakeholders, with trends and improvement proposals.

**What we're looking for**

*Must-have*

• 3+ years of hands-on experience as a Cloud Security Engineer, Cloud Engineer or DevOps Engineer with a security focus.
• Hands-on experience with AWS and/or Google Cloud (GCP). Multi-cloud experience is a strong plus.
• Deep knowledge of the IAM model of at least one cloud provider: roles, policies, trust relationships, AWS STS, GCP Workload Identity and service accounts.
• Ability to read, review and change Terraform (Infrastructure as Code): resource dependencies, module structure and state management.
• Strong Kubernetes security skills: RBAC, NetworkPolicy, Admission Controllers, Pod Security Standards, secrets management (External Secrets, HashiCorp Vault Agent).
• Experience with at least one CSPM tool: AWS Security Hub, GCP Security Command Center, Wiz, Orca Security, Lacework or Prisma Cloud.

*Nice-to-have*

• Has written OPA/Rego policies or AWS Config custom rules in production.
• Cloud penetration testing experience: AWS privilege escalation, GCP lateral movement, metadata service (IMDS) exploitation.
• Certifications: AWS Certified Security – Specialty, Google Professional Cloud Security Engineer, CCSP or equivalent.