Senior Manager Application Security

JOB DESCRIPTION

PURPOSE
To deliver highly technical Information Security Reviews in support of stakeholders from both Business and IT teams across all Group's Business Units, to identify and mitigate of material business risks representing significant threats to the success of the Group's activities.
To contribute to the continuous enhancement of the Information Security Review process by making iterative enhancements to the overall approach, workflow, scope and implementation in alignment with the needs of Group Information Security's customers and according to the changing technical, regulatory and business environment.
The impact for failing to undertake the Information Security Reviews effectively, could include a significant failure in the Group's security posture leading to highly damaging reputation damage, loss of public confidence, regulatory penalties and legal proceedings against the company and its executives.
KEY ACCOUNTABILITIES
The role sits within the Group Information Security - Application Security team and have the accountabilityfor Information Security Review for all the 10 Businessunits in Asia Pacific.
Be the tandem partner with the senior manager leading the Information Security Reviews.
Perform and coordinate Information Security Reviews throughout the lifecycle of a project.
Drive awareness and support to Group IT Security, Group IT and Business Units IT, to understand the I TSecurity Architecture process, as well as their implications across the organizations.
Deliver a consultative service to all stakeholders involved with the Information Security Reviews and, in doing so, provide a measurable benefit to the Group's IT projects in terms of their successful, timely and secure delivery.
The timely identification of key risks leading to their successful remediation without un due delay to the delivery of business objectives.
Act as a Subject Matter Expert for all information security aspects of all projects and, in doing so, facilitate the efficient and secure delivery of those projects.
Identify technical risks as result of the security reviews, ensure these risks are reported to the appropriate risk team (s) to track remediation within the agreed timeframes.
Initiate and evaluate projects, to build and enhance new capabilities in the Company, that related to Identify, Protect, Detect, Respond and Recover to technical risks.
Align security reviews to the Company Group Information Security and overall IT Strategy needs.
Manage allocated resources to deliver the security reviews (either internal staff or vendors).
Collaborate with other Cyber Incident Response and Threat Intel teams on evaluation of weaknesses or new risks that require Group Information Security continuous improvement.
Provide expertise to Business Units when needed, in building local IT Security solutions.
KEY PERFORMANCE INDICATORS
Delivery of security assessments in accordance with the SLAs for this service line.
Deliver a consultative service to all stakeholders involved with the Information Security Reviews and, in doing so, provide a measurable benefit to the Group's IT projects in terms of their successful, timely and secure delivery.
The timely identification of key risks leading to their successful remediation without undue delay to the delivery of business objectives.
Act as a Subject Matter Expert for all information security aspects of all projects and, in doing so, facilitate the efficient and secure delivery of those projects.
EXTERNAL & INTERNAL CONTACTS
Group Head of Application Security
Group CISO
Business Units IT Security Teams
Group and Business Units Chief of Technology and Operations
Group and Business Units IT & Operations
Group and Business Units Internal Audit
External Auditors
Vendors and/or Service Providers

JOB REQUIREMENT

QUALIFICATIONS / EXPERIENCE
University degree from Information Technology or equivalent discipline.
Minimum 8 years working experience in IT Security Management role, preferably in Financial Services.
Regional experience in IT Security Technical or Engineering roles.
Technical experience in Identify, Protect, Detect, Response or Recover areas.
Sufficient experience and Subject Matter Expert level of knowledge in fields of Information Security & solid understanding of project teams' needs. For instance, secure architecture design, risk assessment and remediation & general IT technologies.
Sound consulting capability including, clear and concise written and verbal communications, ability to manage senior stakeholders, and work on high profile projects with tight timelines, always present logical thinking and problemsolving capabilities even under pressures.
KNOWLEDGE & TECHNICAL SKILLS
Certifications or official training on Cloud IAAS, CASB, SIEM solutions, WAF solutions, End Point Protection solutions, Firewall & IPS solutions, NGAV and ED Rsolutions, Orchestration and Automation, Web, Email and DNS Protection, etc.
Excellent interpersonal and influential skills.
Good communication and presentation skills.
Collaborative, consultative and customer service focussed approach to delivery.
Leadership skills, problem solving anddecision making skills; as the incumbenth as to deal with a cross section of stakeholders across 10 countries.

WHAT'S ON OFFER

13th salary
Bonus paid in April next year if joining before Oct 2024
Paid leave up to 22 days per year (prorated for partially joining)
Work remote 1 day per week
Health insurance for employees and direct dependents

CONTACT

PEGASI – IT Recruitment Consultancy | Email: recruit@pegasi.com.vn | Tel: +84 28 3622 8666
We are PEGASI – IT Recruitment Consultancy in Vietnam. If you are looking for new opportunity for your career path, kindly visit our website www.pegasi.com.vn for your reference. Thank you!

Job Summary

Company Type:

Product

Technical Skills:

Security

Location:

Ho Chi Minh - Viet Nam

Working Policy:

Job ID:

J01575

Status:

Close

Related Job:

Senior Backend Engineer (Shop 6.0)

Ho Chi Minh - Viet Nam

Outsource

Design and develop the backend services for the core areas of Shop 6.0 (catalog, orders, payments, ERP Cloud integration) Define API boundaries and ensure consistent, scalable communication between services Own reliable data synchronization between the ERP Cloud and the platform, including error handling and recovery mechanisms Optimize systems for performance and scalability (caching, asynchronous processing, read/write optimization) Establish observability standards (logging, monitoring, alerting) across all backend services Conduct code reviews, promote best practices, and support less experienced team members

Negotiation

View details

Senior Tech Lead (Shop 6.0)

Ho Chi Minh - Viet Nam

Outsource

Take on overall technical and organizational responsibility for delivering Shop 6.0 across frontend, backend, and infrastructure Plan delivery scope, milestones, and releases, and coordinate the work of parallel workstreams (frontend, backend, DevOps, QA) Make and facilitate key architectural decisions together with the senior engineers, particularly around microservices, APIs, and cloud-native implementation on Azure Identify and manage risks related to integration (especially the ERP Cloud connection), scalability, and technical dependencies Serve as the central point of contact for stakeholders on scope, prioritization, and timelines Ensure code quality through reviews, mentoring, and clear standards, including a pull request process with mandatory checks and senior/lead review Ensure transparency on progress, risks, and decisions towards the team and management

Negotiation

View details

Lead Penetration Tester

Ho Chi Minh, Ha Noi - Viet Nam

Outsource

  • Security

Conduct authorized penetration testing for various digital platforms, including web applications, mobile applications, APIs, infrastructure, and cloud environments. Identify and document security vulnerabilities, validate and exploit when necessary, covering areas such as authentication, authorization, session management, input validation, encryption, access control, and business logic issues. Perform security assessments according to industry standards (e.g. OWASP Top 10, OWASP API Security Top 10, OWASP Mobile Security Testing Guide) and relevant security practices. Analyze application flows, user journeys, transaction processes, access controls, and data handling mechanisms to uncover potential security risks. Conduct vulnerability assessment and manual verification to reduce false positives, confirming actual exploitability in authorized environments. Retest to validate remediation effectiveness and ensure vulnerabilities are properly resolved. Support security testing activities within the software development life cycle (SDLC), including security requirement review, threat analysis, test planning, and release security validation. Stay updated with emerging cyber threats, attack techniques, security risks, and security testing best practices. Lead the planning, scoping, and execution of penetration testing activities across assigned projects. Define the penetration testing approach, test strategy, testing scope, priorities, timelines, and required evidence based on project and client requirements. Guide and mentor penetration testers or security engineers in testing methodology, vulnerability validation, reporting quality, and remediation discussions. Review vulnerability findings, risk ratings, evidence, and remediation recommendations to ensure accuracy, consistency, and practical value. Serve as the main technical point of contact for penetration testing activities, working with client stakeholders, security teams, development teams, DevOps, infrastructure teams, and compliance teams. Facilitate vulnerability walkthroughs, risk clarification sessions, remediation discussions, and retesting alignment with relevant stakeholders. Support estimation, planning, status tracking, issue escalation, and delivery reporting for security testing activities. Contribute to improving security testing processes, reporting templates, testing checklists, knowledge sharing, and reusable testing practices. Support regulatory, audit, and compliance requirements by providing security testing evidence, reports, remediation status, and technical clarification when needed.

Negotiation

View details