LevelStaff
Employment typeFull-time
EducationUniversity
Headcount1 person
WorkplaceOn-site
GenderNo requirement
Application deadline: 08/11/2026 (8 days left)
DevOps Engineer (English Fluent)
Công ty TNHH ITECHWXStaff
SalaryNegotiable
LocationHo Chi Minh City
Experience2 - 5 years
Application deadline08/11/2026
How well you match
Comparing your profile…
Job description
- Platform & DevOps — the core of the job:
- Build, operate and troubleshoot CI/CD pipelines across multiple .NET services, Azure Functions and a React front end; keep daily pipeline health green and unblock failed builds fast.
- Provision and manage Azure resources — App Service, Functions, Storage, Azure SQL, Service Bus, Redis, AI Search / Azure OpenAI, VMSS and container workloads - preferably through Infrastructure as Code.
- Own environment configuration, service connections, agent pools, build/release branch policies and deployment approvals.
- Manage identity and access: Entra ID app registrations, service principals, managed identities, RBAC, JIT/PIM elevation; review and clean up stale permissions on a schedule.
- Rotate secrets and certificates on schedule; move credentials into Key Vault and eliminate local / shared-key auth.
- Monitor platform health, availability and cost: Application Insights, Log Analytics / KQL, alert rules, budgets; respond to and drive incidents to resolution.
- Support developers day to day — grant deployment permissions, provision resources, triage DevOps requests — and document runbooks, FAQs and technical guidance.
- Plan and execute infrastructure lifecycle work: decommissioning, platform and runtime upgrades, migrations.
- Security & compliance engineering — what makes this role different:
- Drive security action items to closure: CVE and dependency vulnerability remediation, OS and runtime patching, and cloud-security recommendations (target: secure score ≥ 95%).
- Remediate static-analysis findings with the dev team — e.g. SSRF, disabled certificate validation, credential leaks — not just file them as bugs.
- Harden cloud posture: disable public network access, enforce private endpoints and end-to-end TLS, disable local auth on PaaS resources, manage IP / service tags, apply least privilege.
- Prepare and shepherd security design reviews and threat models for each product; run reviewer feedback rounds through to approval and keep due dates from slipping.
- Run annual assessments — security, privacy, accessibility, business continuity / DR — and keep the service registry, asset inventory and subscription classification accurate.
- Support Responsible AI reviews for AI features: document AI use cases and changes, coordinate harm testing (harmful content, jailbreak / prompt injection, groundedness), and record risks and mitigations.
- Enforce supply-chain controls in release pipelines: SBOM generation, approved package feeds, production-branch change management, code signing and anti malware gates.
- Report compliance status weekly to engineering and program management; forecast due dates, negotiate extensions and escalate blockers early.
- Ways of working:
- Participate in sprint planning; break security and compliance findings into actionable stories and tasks in Azure DevOps.
- Automate repetitive ops and compliance work with scripts, pipelines and AI / agent tooling. The team is moving from DevOps toward AIOps — our stated goal is for recurring SFI / S360 compliance tickets to be triaged, remediated and closed by agents, with humans only at approval gates. You will help build that
Requirements
- Must-Have Skills:
- DevOps capability is required — and the years must be DevOps years. We are hiring an engineer who builds and automates, not an operator who only follows checklists. A mixed background is welcome (e.g. 3 years software development + 3 years DevOps), but time spent purely in software development does not substitute for the DevOps requirement.
- Azure, hands-on: App Service, Azure Functions, Storage, Key Vault, Service Bus, Azure SQL, networking (VNet, Private Endpoint, NSG, firewall), Entra ID / RBAC / managed identity.
- CI/CD: strong Azure DevOps Pipelines (YAML); plus any of GitHub Actions, Jenkins, GitLab CI.
- Infrastructure as Code: Bicep, ARM templates or Terraform (Ansible a plus).
- Containerization & orchestration: Docker; Kubernetes / Helm fundamentals.
- Scripting & automation: PowerShell and/or Python, plus Bash. You must be able to write automation, not only click through portals.
- Application security fundamentals: OWASP Top 10, threat modeling (e.g. STRIDE), SAST / DAST / SCA concepts, CVE triage and patching, secrets management, least privilege.
- Observability: Application Insights, Log Analytics / KQL, alerting, basic incident response.
- Git and branch / release governance.
- Working English — you will read Microsoft security standards, write status updates, and work directly with reviewers and program managers
- Nice-to-Have — AI & automation engineering:
- Optional — but this is where we are heading, and it is the biggest differentiator in this hire. Compliance work today is highly repetitive: the same classes of S360 / SFI action items arrive every week and are handled by hand. Our goal is for an agent to do that work, and for delivery itself to run as an automated pipeline with humans only at approval gates.
- Agentic / AI-assisted automation — Azure OpenAI or equivalent LLM APIs, prompt and context engineering, agent frameworks (Semantic Kernel, AutoGen, LangChain, MCP), retrieval-augmented generation.
- Ticket-driven auto-remediation — an agent that reads a security or compliance action item (S360 / SFI / IcM), classifies it, gathers the evidence, proposes or applies the fix, and closes the loop — instead of an engineer repeating it every day.
- End-to-end delivery automation — from ADO work item → requirement / design → implementation → pull request → automated gates (code-quality / SAST, unit + integration tests, QA and acceptance gate, security and compliance gate) → release notes and deployment, with human approval only where it genuinely matters.
- Test automation that feeds those gates — unit, integration and E2E automation (e.g. Playwright), coverage thresholds and quality gates wired directly into pipelines.
- Practical experience with GitHub Copilot / Copilot Studio / Power Automate, MCP servers, or custom agents that call Azure DevOps and Azure APIs.
- The instinct we look for: if you did it by hand twice, you automate it the third time.
- Nice-to-Have — Microsoft internal tools:
- Optional. Nothing in this section is required — we will train you. A strong DevOps engineer typically picks these up within the first 2–3 months
- S360 / Service Tree — service registration, subscription Production vs Non Production classification, action-item dashboards.
- SFI (Secure Future Initiative) — security wave action items and remediation tracking.
- SDL / OneTrIP — SDL review, Privacy review, Responsible AI release assessment, Accessibility (ACE), BCDR Manager.
- 1ES Pipeline Templates, CodeQL, CredScan, BinSkim, Component Governance, CFS package feeds.
- Microsoft Defender for Cloud, AzTS, MISE, IcM.
- Responsible AI evaluation practices; GDPR / ISO 27001 / SOC 2 awareness.
- Certifications: AZ-400, AZ-500, SC-100.
- Qualifications:
- Bachelor's degree in Computer Science, Information Technology, Information Security or equivalent practical experience.
- 3+ years of DevOps experience is required — in a DevOps / Cloud Engineering / SRE / DevSecOps role, including hands-on Azure. Time spent purely in software development does not count toward this.
- Ownership mindset — you chase items to closure across teams, vendors and time zones, and you raise risk before it becomes a missed deadline.
- Comfortable being a single point of contact: communicating clear status to managers and working with external security reviewers.
- Strong problem-solving, documentation and cross-team communication skills.
Benefits for candidates
- Competitive Salary (negotiable)
- Salary at 100% during the probationary period
- 90% contribution of the gross salary to social insurance
- 20 days leave (12 days of annual leave and 8 days of sick leave)
- Annual health check up
- Full working equipment will be provided
- Activities: Birthday party, Employee engagement activities
Location and working hours
Work location
- Ho Chi Minh City: Vista Building, 19 Tan Cang St.,, Phường Thạnh Mỹ Tây
How to apply
Apply online by clicking Apply now below.
Application deadline
08/11/2026 (8 days left)
Rate this job post
—No ratings yet
Rate this job
Choose a star rating for this job post.
22 - 35 million VNDHanoiTeam leadFull-time
3 days ago21 days left
19 - 20 million VNDHo Chi Minh CityExperienced staffFull-time
3 days ago28 days left
NegotiableHanoiExperienced staffFull-time
4 days ago27 days left
23 - 30 million VNDHanoiExperienced staffFull-time
4 days ago27 days left
NegotiableHanoiExperienced staffFull-time
8 hours ago30 days left
NegotiableHanoiTeam leadFull-time
5 days ago26 days left
12 - 15 million VNDHanoiExperienced staffFull-time
5 days ago26 days left
25 - 40 million VNDHanoiExperienced staffFull-time
6 days ago25 days left
NegotiableHo Chi Minh CityExperienced staffFull-time
6 days ago25 days left
25 - 45 million VNDHanoiExperienced staffFull-time
5 days ago26 days left
CV builderPrepare your CV before you apply
Choose a template, prefill it from your profile and download a PDF to apply right away.
Create CV