7 hours ago
Ho Chi Minh City, VietnamMid Level
Responsibilities
- Integrate secret scanning, SAST, SCA/SBOM, container, IaC, and DAST checks into pull request, build, and release workflows.
- Implement risk-based CI/CD security gates, false-positive handling, and documented exceptions.
- Build scripts and API integrations for scan aggregation, ticketing, evidence collection, and security reporting.
- Track scan coverage, gate decisions, vulnerability trends, and control adoption.
- Partner with AppSec, Product Engineering, Platform/SRE, and Security Operations and enable Product Security, Security Champions, and SRE teams.
- Use AI tools responsibly for analysis, scripting, and documentation while verifying generated outputs.
Requirements
- Bachelor’s degree in Computer Science, Engineering, or Cybersecurity, or equivalent practical experience.
- At least 3 years of experience in DevSecOps, DevOps/platform engineering, AppSec, or software engineering with security automation.
- Hands-on experience with Git and CI/CD platforms such as GitHub Actions, GitLab CI, Jenkins, or Azure DevOps.
- Ability to automate workflows using Python, Bash, or similar languages and work with APIs.
- Experience with security scanning, finding triage, and vulnerability remediation.
- Working knowledge of Secure SDLC, Linux, containers, cloud fundamentals, and OWASP Top 10.
- Strong developer collaboration skills and effective use of AI assistants with appropriate review of generated outputs.
- Preferred experience with Kubernetes, Terraform, AWS, Azure, and container build/release workflows.
- Preferred exposure to CodeQL, Semgrep, SonarQube, Snyk, Trivy, Gitleaks, Checkov, or ZAP.
- Preferred knowledge of SBOM, software supply-chain security, signing/attestation, OWASP SAMM, or NIST SSDF.
- Experience with AI-assisted SDLC, AI coding assistants, AI-driven security reviews, or remediation automation is a plus.
Categories
About OPSWAT
OPSWAT builds cybersecurity software for critical infrastructure, delivering malware prevention, content disarm and reconstruction, secure file transfer, and device access control across IT, OT, and ICS environments. It sells enterprise software and SaaS platforms to public- and private-sector organizations worldwide. Founded in 2002 and headquartered in Tampa, Florida, the privately held company is used in regulated industries such as energy, government, and finance.