Senior Information Security Officer (Security Control & Compliance)

Implementing and operating application security solutions such as WAF, DDoS protection, and PAM (Privileged Access Management).

Monitoring privileged access activities, detecting abnormal behavior, and escalating security risks.

Collaborating with development and infrastructure teams to embed security measures across the application lifecycle (SDLC/DevSecOps).

Supporting application vulnerability assessment activities and tracking remediation progress.

Supporting the development, maintenance, and updates of information security policies and procedures.

Ensuring compliance with internal security standards and external regulatory requirements, and preparing documentation and reports for internal and external audits.

Monitoring application-related security events and access activities, analyzing and reporting security risks, vulnerabilities, and incidents to management.

Tracking the remediation status of identified security issues and ensuring timely resolution.

Supporting the execution of information security awareness programs for employees and assisting in developing related training materials and communication.

Participating in the research, testing, and deployment of new application security solutions, and supporting security-related initiatives in digital transformation and system upgrade projects.

Contributing to security requirement definition in IT and business projects.

Proficiency in web application security and OWASP Top 10.

Familiarity with security tools like WAF, PAM, DDoS protection, SIEM is beneficial.

Understanding of SDLC/DevSecOps processes.

Knowledge of information security standards such as ISO 27001, NIST, CIS, and compliance frameworks.

Strong analytical and problem-solving skills in dealing with security incidents and vulnerabilities.

Ability to collaborate with cross-functional teams.

Proficient in reporting and documentation with strong logical thinking.

Bachelor's degree in Information Technology, Computer Science, Information Security, or related fields.

2-5 years of experience in Application Security, Information Security, or IT Security roles.

Preference for certifications in Application Security (CEH, eWPT, eJPT, BSCP or equivalent).

ISO/IEC 27001 Lead Implementer/Lead Auditor or CISA qualifications.

SC-300 (Identity & Access Management) certification or IAM/PAM experience.

Experience in banking, securities, fintech, or regulated financial environments is a plus.

PEGASI – IT Recruitment Consultancy | Email: recruit@pegasi.com.vn | Tel: +84 28 3622 8666