Security Manager

Location: HN - Technopark / HCM - VinCom Đồng Khởi

Report Line: Director

**About the Role**

Green SM is looking for a Head of Product Security & Compliance to build and lead our global security and compliance function across a highly complex, multi-cloud, multi-jurisdiction environment. Our infrastructure spans AWS, GCP, Azure, Huawei Cloud, Yandex Cloud, and on-premises systems, supporting operations across Southeast Asia, Central Asia, and the EU.

This is a hands-on leadership role for someone who can operate at both strategic and technical depth — architecting secure-by-design products, running a mature Product Security program, and ensuring the company stays compliant with a rapidly evolving patchwork of national data protection and cybersecurity laws. You will own the end-to-end security posture of our products and platforms, lead multi-disciplinary security teams, and act as the primary bridge between engineering, compliance, and executive leadership on all matters of security risk.

**Key Responsibilities**

**Security & Compliance Leadership**

• Build, own, and continuously mature the end-to-end Product Security and Compliance program across all company products and markets.
• Lead and manage multi-disciplinary security teams spanning Application Security, Security Architecture, Penetration Testing, DevSecOps, and Cloud Security Operations.
• Define and report Security & Compliance KPIs and risk metrics to executive stakeholders and the board.
• Translate technical security and regulatory risk into business impact and actionable decisions for leadership.

**Secure Product Development**

• Define, implement, and enforce a Secure SDLC, embedding security from design through production across all engineering teams.
• Drive security architecture reviews and threat modeling for new and existing products.
• Ensure secure usage of cloud-native services, APIs, and third-party dependencies across the product portfolio.

**Vulnerability & Offensive Security Management**

• Own product vulnerability management end-to-end: discovery, triage, risk-based prioritization, remediation tracking, and verification.
• Define and oversee the offensive security strategy — pentesting scope, cadence, vendor management, and remediation follow-up.

**Multi-Cloud Security Architecture**

• Set and enforce unified security architecture standards across a heterogeneous multi-cloud environment (AWS, GCP, Azure, Huawei Cloud, Yandex Cloud, on-premises).
• Own identity and access architecture, including enterprise SSO, short-lived session tokens, and least-privilege access mapping across all cloud providers.
• Oversee Cloud-Native Application Protection Platform (CNAPP) coverage and automated misconfiguration containment across all environments.
• Ensure cryptographic key management practices (BYOK/CMEK, HSMs, vendor-agnostic key custody) meet data sovereignty requirements in each market.

**Global Compliance & Data Sovereignty**

• Own and continuously maintain the company’s compliance map across all operating jurisdictions, including Vietnam (Decree 13/2023/ND-CP – PDPD), Indonesia (Law No. 27/2022 – UU PDP), the Philippines (RA 10173 – DPA), Kazakhstan (Law No. 94-V), Laos and Cambodia (cybersecurity/e-commerce regulations), and the EU (GDPR and the Danish Data Protection Act for Denmark operations).
• Translate country-specific data localization, sovereignty, and breach-notification requirements into concrete technical and process controls.
• Coordinate with local Data Protection Officers, legal counsel, and regulators as required (e.g., Privacy Impact Assessments, breach reporting timelines).
• Maintain continuous audit readiness across all markets and cloud environments.

**Incident Response & Governance**

• Lead product-related security incidents end-to-end, including root cause analysis and long-term corrective actions.
• Partner with Engineering, Product, Legal, and Infrastructure leadership to align security and compliance posture with business objectives.

**Requirements**

• 10-12+ years of experience in Product Security, Application Security, Security Operations, or DevSecOps, including experience in a multinational, multi-cloud environment.
• Proven experience building or scaling a Product Security and/or Compliance function in a product-based organization.
• Strong expertise in Secure SDLC and embedding security into modern development workflows (CI/CD, cloud-native architectures).
• Hands-on experience with application security testing, threat modeling, and secure architecture reviews.
• Solid working knowledge of major cloud platforms (AWS, GCP, Azure); exposure to Huawei Cloud and/or Yandex Cloud is a strong plus.
• Practical understanding of international data protection and cybersecurity regulations (e.g., GDPR and at least one APAC/Central Asia data privacy law) and the ability to translate them into technical controls.
• Experience managing multi-disciplinary security teams across AppSec, Pentest, DevSecOps, and Cloud Security.
• Experience owning vulnerability lifecycle management with risk-based prioritization.
• Willingness and ability to travel regionally (SEA, Central Asia, EU) as required by business needs.
• Strong written and verbal communication skills in English; additional regional languages are a plus.

**Nice to Have**

• Professional certifications such as CISSP, CISM, CCSP, OSCP, or equivalent.
• Prior experience in mobility, ride-hailing, fintech, or IoT/telematics businesses handling real-time location or payment data.
• Experience working directly with Data Protection Officers, regulators, or auditors across multiple jurisdictions.
• Familiarity with Zero-Trust architecture, mTLS, and cryptographic key management (HSMs, CMEK/BYOK)