Tuyển dụng DevOps Engineer (English Fluent) tại Hồ Chí Minh

Platform & DevOps — the core of the job

• Build, operate and troubleshoot CI/CD pipelines across multiple .NET services, Azure Functions and a React front end; keep daily pipeline health green and unblock failed builds fast.
• Provision and manage Azure resources — App Service, Functions, Storage, Azure SQL, Service Bus, Redis, AI Search / Azure OpenAI, VMSS and container workloads - preferably through Infrastructure as Code.
• Own environment configuration, service connections, agent pools, build/release branch policies and deployment approvals.
• Manage identity and access: Entra ID app registrations, service principals, managed identities, RBAC, JIT/PIM elevation; review and clean up stale permissions on a schedule.
• Rotate secrets and certificates on schedule; move credentials into Key Vault and eliminate local / shared-key auth.
• Monitor platform health, availability and cost: Application Insights, Log Analytics / KQL, alert rules, budgets; respond to and drive incidents to resolution.
• Support developers day to day — grant deployment permissions, provision resources, triage DevOps requests — and document runbooks, FAQs and technical guidance.
• Plan and execute infrastructure lifecycle work: decommissioning, platform and runtime upgrades, migrations.

Security & compliance engineering — what makes this role different

• Drive security action items to closure: CVE and dependency vulnerability remediation, OS and runtime patching, and cloud-security recommendations (target: secure score ≥ 95%).
• Remediate static-analysis findings with the dev team — e.g. SSRF, disabled certificate validation, credential leaks — not just file them as bugs.
• Harden cloud posture: disable public network access, enforce private endpoints and end-to-end TLS, disable local auth on PaaS resources, manage IP / service tags, apply least privilege.
• Prepare and shepherd security design reviews and threat models for each product; run reviewer feedback rounds through to approval and keep due dates from slipping.
• Run annual assessments — security, privacy, accessibility, business continuity / DR — and keep the service registry, asset inventory and subscription classification accurate.
• Support Responsible AI reviews for AI features: document AI use cases and changes, coordinate harm testing (harmful content, jailbreak / prompt injection, groundedness), and record risks and mitigations.
• Enforce supply-chain controls in release pipelines: SBOM generation, approved package feeds, production-branch change management, code signing and anti malware gates.
• Report compliance status weekly to engineering and program management; forecast due dates, negotiate extensions and escalate blockers early.

Ways of working

• Participate in sprint planning; break security and compliance findings into actionable stories and tasks in Azure DevOps.
• Automate repetitive ops and compliance work with scripts, pipelines and AI / agent tooling. The team is moving from DevOps toward AIOps — our stated goal is for recurring SFI / S360 compliance tickets to be triaged, remediated and closed by agents, with humans only at approval gates. You will help build that

Yêu cầu ứng viên

Must-Have Skills

• DevOps capability is required — and the years must be DevOps years. We are hiring an engineer who builds and automates, not an operator who only follows checklists. A mixed background is welcome (e.g. 3 years software development + 3 years DevOps), but time spent purely in software development does not substitute for the DevOps requirement.
• Azure, hands-on: App Service, Azure Functions, Storage, Key Vault, Service Bus, Azure SQL, networking (VNet, Private Endpoint, NSG, firewall), Entra ID / RBAC / managed identity.
• CI/CD: strong Azure DevOps Pipelines (YAML); plus any of GitHub Actions, Jenkins, GitLab CI.
• Infrastructure as Code: Bicep, ARM templates or Terraform (Ansible a plus).
• Containerization & orchestration: Docker; Kubernetes / Helm fundamentals.
• Scripting & automation: PowerShell and/or Python, plus Bash. You must be able to write automation, not only click through portals.
• Application security fundamentals: OWASP Top 10, threat modeling (e.g. STRIDE), SAST / DAST / SCA concepts, CVE triage and patching, secrets management, least privilege.
• Observability: Application Insights, Log Analytics / KQL, alerting, basic incident response.
• Git and branch / release governance.
• Working English — you will read Microsoft security standards, write status updates, and work directly with reviewers and program managers

Nice-to-Have — AI & automation engineering

• Optional — but this is where we are heading, and it is the biggest differentiator in this hire. Compliance work today is highly repetitive: the same classes of S360 / SFI action items arrive every week and are handled by hand. Our goal is for an agent to do that work, and for delivery itself to run as an automated pipeline with humans only at approval gates.
• Agentic / AI-assisted automation — Azure OpenAI or equivalent LLM APIs, prompt and context engineering, agent frameworks (Semantic Kernel, AutoGen, LangChain, MCP), retrieval-augmented generation.
• Ticket-driven auto-remediation — an agent that reads a security or compliance action item (S360 / SFI / IcM), classifies it, gathers the evidence, proposes or applies the fix, and closes the loop — instead of an engineer repeating it every day.
• End-to-end delivery automation — from ADO work item → requirement / design → implementation → pull request → automated gates (code-quality / SAST, unit + integration tests, QA and acceptance gate, security and compliance gate) → release notes and deployment, with human approval only where it genuinely matters.
• Test automation that feeds those gates — unit, integration and E2E automation (e.g.