Head of Security

ACG_3800_JOB Our client, a leading company in financial services sector in Vietnam, is looking for a qualified candidate to join their firm. KEY RESPONSIBILITIES 1. Security Engineering & Architecture Define and lead the technical security architecture strategy for the company’s exchange platform, cloud infrastructure, and production systems. Design and deploy Zero Trust security models across both internal and production environments. Establish security standards for cloud-native infrastructure and Kubernetes-based environments. Lead the implementation of identity-focused security controls, including MFA/2FA, RBAC, PAM, workload identity, and device trust models. Develop and enforce security hardening standards for servers, endpoints, containers, APIs, and production workloads. 2. Cloud & Infrastructure Security Secure cloud-native infrastructure and Kubernetes environments through runtime protection, network segmentation, policy enforcement, and workload isolation. Implement and optimize CSPM, CWPP, EDR/XDR, SIEM, NGFW, and cloud security monitoring solutions. Develop scalable threat detection and response capabilities for cloud infrastructure and production systems. Oversee infrastructure vulnerability remediation and patch management governance across production environments. 3. Exchange & Wallet Security Design and implement security measures for hot wallets, cold wallets, custody systems, MPC infrastructure, and key management platforms. Work closely with blockchain and backend engineering teams to secure exchange APIs, wallet services, transaction systems, and blockchain integrations. Establish monitoring and anomaly detection capabilities to identify suspicious wallet activities, unauthorized transactions, and account takeover attempts. Strengthen protection against cryptocurrency-specific threats, including API abuse, credential stuffing, wallet compromise, and insider threats. Establish operational security standards for executives and key personnel, including safeguards for employees with privileged access to wallet and key management systems against targeted physical attacks and coercion-based threats. 4. Application Security & DevSecOps Establish and implement secure SDLC and DevSecOps practices across engineering teams. Integrate SAST, DAST, SCA, secrets scanning, container scanning, and Infrastructure as Code (IaC) scanning into CI/CD pipelines. Lead application threat modeling, secure architecture reviews, and security design assessments. Implement software supply chain security measures in accordance with modern software integrity standards. Coordinate penetration testing activities and collaborate with product and engineering teams to address identified vulnerabilities. 5. Security Operations & Incident Response Develop and operate technical security monitoring and threat detection capabilities aligned with MITRE ATT&CK methodologies. Lead technical incident response activities, including incident triage, containment, root cause analysis, and remediation coordination. Perform threat hunting, forensic investigations, malware analysis, and purple-team exercises. Participate in cryptocurrency industry threat intelligence-sharing communities and ISACs, and integrate shared indicators of compromise into the company's detection and monitoring systems. Develop operational runbooks, incident response playbooks, and security automation workflows for production security operations. Collaborate with Risk Management and Information Security teams in handling major incidents and conducting post-incident reviews. 6. Collaboration & Technical Governance Work closely with Risk Management, Compliance, and Information Security teams to support audit readiness and the implementation of security controls. Ensure accurate and timely incident reporting to Vietnamese regulatory authorities, including the State Bank of Vietnam, Ministry of Public Security/A05, and VNCERT/CC, in coordination with Legal, Compliance, and Risk Management teams, in accordance with Decree 331/2026/ND-CP on Level 4 security requirements and Decree 356/2025/ND-CP on personal data protection. Provide technical security guidance to Engineering, DevOps, Infrastructure, and Product teams. Support security assessments of third-party systems, infrastructure vendors, and technology integrations. Promote security awareness and foster a secure engineering culture across technical teams. Establish and oversee vulnerability disclosure, bug bounty, and white-hat engagement policies, including procedures for handling funds recovered during an exploit and coordinating with external security researchers. Requirements Bachelor’s degree in Computer Science, Information Security, Computer Engineering, or a related field. At least 8 years of experience in cybersecurity or security engineering, including 3–5 years in leadership or management positions. Strong hands-on expertise in cloud security, Kubernetes security, infrastructure hardening, and modern security operations. Proven experience in securing large-scale cloud-native production environments and internet-facing platforms. In-depth understanding of DevSecOps, application security, CI/CD security, and software supply chain security. Strong technical knowledge of digital asset exchange security, wallet infrastructure, cryptographic key management, and blockchain-related security threats. Experience working with SIEM, EDR/XDR, CSPM, CWPP, IAM/PAM, and security observability platforms. Practical experience in incident response, threat hunting, vulnerability management, penetration testing, and security automation. Familiarity with modern cyberattack techniques targeting cryptocurrency exchanges and financial platforms. Strong communication and stakeholder management skills, with the ability to collaborate effectively across engineering and governance teams. Preferred Qualifications Working knowledge of Vietnamese cybersecurity and data protection regulatory reporting requirements, including the Law on Cybersecurity and Decree 13/2023/ND-CP, along with experience engaging with authorities such as the State Bank of Vietnam, Ministry of Public Security, and VNCERT/CC. Experience working in cryptocurrency exchanges, fintech companies, payment platforms, or large-scale internet services. Familiarity with MPC, HSM, blockchain infrastructure, wallet custody systems, and Web3 security models. Practical experience coordinating security incidents with external stakeholders in the cryptocurrency ecosystem, including other exchanges, custodians, blockchain foundations, and blockchain analytics providers. Experience establishing or expanding SOC, DevSecOps, or Security Engineering teams. Professional security certifications such as CISSP, CCSP, OSCP, GIAC, Certified Kubernetes Security Specialist (CKS), or cloud security certifications are preferred. Familiarity with cryptocurrency-specific security frameworks and industry initiatives, including Whitehat Safe Harbor and cryptocurrency ISAC threat intelligence-sharing practices. Contact: Thao Phan, Giang Van or Gia Huy Due to the immense number of applicants, only shortlisted candidates will be contacted.