Tìm việc làm IT

Crossian is a high-growth technology-driven e-commerce business. As a start-up formed in 2020, we have created a fast-paced and dynamic environment, enabling our people to reach a cumulative average growth rate of over 1000% in the last 5 years.

About the role

• We are looking for an Application Security Engineer to embed security into software delivery, assess applications and cloud workloads, and drive vulnerabilities through to verified resolution. You will partner with engineering and DevOps teams to implement practical controls, provide security guidance, and balance risk with business and delivery needs.

Secure SDLC & DevSecOps

• Define security requirements, security gates, and design reviews across the design, development, testing, and deployment stages of the SDLC.
• Integrate and automate SAST, DAST, SCA, secret scanning, and container/IaC scanning in CI/CD pipelines; tune findings to reduce false positives and improve developer workflows.

Security assessment & penetration testing

• Assess and penetration-test web and mobile applications, APIs, and backend services using OWASP guidance, with attention to authentication, authorization, and business logic.
• Perform manual and automated security code reviews of high-risk functionality; help developers identify root causes and implement effective remediation.

Vulnerability lifecycle management

• Manage application vulnerabilities from discovery, validation, and risk-based prioritization through remediation, retesting, and closure against agreed SLAs; escalate overdue findings and track approved exceptions.
• Assess risks in third-party libraries, open-source dependencies, and software components using Software Composition Analysis (SCA) and Software Bills of Materials (SBOMs).

Cloud workload security

• Assess and implement security controls for application workloads on cloud platforms such as AWS, Azure, or GCP.
• Partner with DevOps to review containers, Kubernetes, serverless services, IAM/service identities, secrets, and Infrastructure as Code (IaC) against security baselines.

Incident response & collaboration

• Support application security incident investigations and use lessons learned to strengthen preventive controls and development practices.
• Coordinate external penetration tests, including scope definition, findings follow-up, and remediation retesting.
• Provide practical secure coding guidance, training, and support to engineering teams.

• Intermediate: Typically 3+ years of relevant experience, able to deliver defined assessments and security improvements with guidance on complex decisions. Senior: Typically 5+ years, with demonstrated ownership of application security practices, complex assessments, and cross-team remediation.
• Hands-on application/API penetration testing and security code review experience, with strong knowledge of OWASP guidance, authentication, authorization, and business-logic vulnerabilities.
• Experience integrating and tuning security testing tools in CI/CD pipelines and applying Secure SDLC practices.
• Experience validating, prioritizing, and tracking vulnerabilities through verified closure, including dependency risk management using SCA/SBOM.
• Working knowledge of at least one major cloud platform, container/Kubernetes security, IAM, secrets management, and IaC review.
• Ability to read application code and write scripts to automate security tasks.
• Clear communication and reporting skills; able to explain risk, recommend practical fixes, and collaborate with developers and stakeholders.

Preferred qualifications

• Experience with mobile application testing, threat modeling, or application security incident investigations.
• Relevant application security, penetration testing, or cloud security certifications are welcome but not required.