DevOps Engineer (English Fluent)

Công ty TNHH ITECHWXNhân viên

Mức lươngThoả thuận

Địa điểmHồ Chí Minh

Kinh nghiệm2 - 5 năm

Hạn nộp hồ sơ08/11/2026

Cấp bậcNhân viên

Hình thức làm việcToàn thời gian

Học vấnĐại học

Số lượng tuyển1 người

Nơi làm việcTại văn phòng

Giới tínhKhông yêu cầu

Hạn nộp hồ sơ: 08/11/2026 (Còn 8 ngày)

Mức độ phù hợp với bạn

Đang đối chiếu hồ sơ của bạn…

Mô tả công việc

Platform & DevOps — the core of the job:
Build, operate and troubleshoot CI/CD pipelines across multiple .NET services, Azure Functions and a React front end; keep daily pipeline health green and unblock failed builds fast.
Provision and manage Azure resources — App Service, Functions, Storage, Azure SQL, Service Bus, Redis, AI Search / Azure OpenAI, VMSS and container workloads - preferably through Infrastructure as Code.
Own environment configuration, service connections, agent pools, build/release branch policies and deployment approvals.
Manage identity and access: Entra ID app registrations, service principals, managed identities, RBAC, JIT/PIM elevation; review and clean up stale permissions on a schedule.
Rotate secrets and certificates on schedule; move credentials into Key Vault and eliminate local / shared-key auth.
Monitor platform health, availability and cost: Application Insights, Log Analytics / KQL, alert rules, budgets; respond to and drive incidents to resolution.
Support developers day to day — grant deployment permissions, provision resources, triage DevOps requests — and document runbooks, FAQs and technical guidance.
Plan and execute infrastructure lifecycle work: decommissioning, platform and runtime upgrades, migrations.
Security & compliance engineering — what makes this role different:
Drive security action items to closure: CVE and dependency vulnerability remediation, OS and runtime patching, and cloud-security recommendations (target: secure score ≥ 95%).
Remediate static-analysis findings with the dev team — e.g. SSRF, disabled certificate validation, credential leaks — not just file them as bugs.
Harden cloud posture: disable public network access, enforce private endpoints and end-to-end TLS, disable local auth on PaaS resources, manage IP / service tags, apply least privilege.
Prepare and shepherd security design reviews and threat models for each product; run reviewer feedback rounds through to approval and keep due dates from slipping.
Run annual assessments — security, privacy, accessibility, business continuity / DR — and keep the service registry, asset inventory and subscription classification accurate.
Support Responsible AI reviews for AI features: document AI use cases and changes, coordinate harm testing (harmful content, jailbreak / prompt injection, groundedness), and record risks and mitigations.
Enforce supply-chain controls in release pipelines: SBOM generation, approved package feeds, production-branch change management, code signing and anti malware gates.
Report compliance status weekly to engineering and program management; forecast due dates, negotiate extensions and escalate blockers early.
Ways of working:
Participate in sprint planning; break security and compliance findings into actionable stories and tasks in Azure DevOps.
Automate repetitive ops and compliance work with scripts, pipelines and AI / agent tooling. The team is moving from DevOps toward AIOps — our stated goal is for recurring SFI / S360 compliance tickets to be triaged, remediated and closed by agents, with humans only at approval gates. You will help build that

Yêu cầu công việc

Must-Have Skills:
DevOps capability is required — and the years must be DevOps years. We are hiring an engineer who builds and automates, not an operator who only follows checklists. A mixed background is welcome (e.g. 3 years software development + 3 years DevOps), but time spent purely in software development does not substitute for the DevOps requirement.
Azure, hands-on: App Service, Azure Functions, Storage, Key Vault, Service Bus, Azure SQL, networking (VNet, Private Endpoint, NSG, firewall), Entra ID / RBAC / managed identity.
CI/CD: strong Azure DevOps Pipelines (YAML); plus any of GitHub Actions, Jenkins, GitLab CI.
Infrastructure as Code: Bicep, ARM templates or Terraform (Ansible a plus).
Containerization & orchestration: Docker; Kubernetes / Helm fundamentals.
Scripting & automation: PowerShell and/or Python, plus Bash. You must be able to write automation, not only click through portals.
Application security fundamentals: OWASP Top 10, threat modeling (e.g. STRIDE), SAST / DAST / SCA concepts, CVE triage and patching, secrets management, least privilege.
Observability: Application Insights, Log Analytics / KQL, alerting, basic incident response.
Git and branch / release governance.
Working English — you will read Microsoft security standards, write status updates, and work directly with reviewers and program managers
Nice-to-Have — AI & automation engineering:
Optional — but this is where we are heading, and it is the biggest differentiator in this hire. Compliance work today is highly repetitive: the same classes of S360 / SFI action items arrive every week and are handled by hand. Our goal is for an agent to do that work, and for delivery itself to run as an automated pipeline with humans only at approval gates.
Agentic / AI-assisted automation — Azure OpenAI or equivalent LLM APIs, prompt and context engineering, agent frameworks (Semantic Kernel, AutoGen, LangChain, MCP), retrieval-augmented generation.
Ticket-driven auto-remediation — an agent that reads a security or compliance action item (S360 / SFI / IcM), classifies it, gathers the evidence, proposes or applies the fix, and closes the loop — instead of an engineer repeating it every day.
End-to-end delivery automation — from ADO work item → requirement / design → implementation → pull request → automated gates (code-quality / SAST, unit + integration tests, QA and acceptance gate, security and compliance gate) → release notes and deployment, with human approval only where it genuinely matters.
Test automation that feeds those gates — unit, integration and E2E automation (e.g. Playwright), coverage thresholds and quality gates wired directly into pipelines.
Practical experience with GitHub Copilot / Copilot Studio / Power Automate, MCP servers, or custom agents that call Azure DevOps and Azure APIs.
The instinct we look for: if you did it by hand twice, you automate it the third time.
Nice-to-Have — Microsoft internal tools:
Optional. Nothing in this section is required — we will train you. A strong DevOps engineer typically picks these up within the first 2–3 months
S360 / Service Tree — service registration, subscription Production vs Non Production classification, action-item dashboards.
SFI (Secure Future Initiative) — security wave action items and remediation tracking.
SDL / OneTrIP — SDL review, Privacy review, Responsible AI release assessment, Accessibility (ACE), BCDR Manager.
1ES Pipeline Templates, CodeQL, CredScan, BinSkim, Component Governance, CFS package feeds.
Microsoft Defender for Cloud, AzTS, MISE, IcM.
Responsible AI evaluation practices; GDPR / ISO 27001 / SOC 2 awareness.
Certifications: AZ-400, AZ-500, SC-100.
Qualifications:
Bachelor's degree in Computer Science, Information Technology, Information Security or equivalent practical experience.
3+ years of DevOps experience is required — in a DevOps / Cloud Engineering / SRE / DevSecOps role, including hands-on Azure. Time spent purely in software development does not count toward this.
Ownership mindset — you chase items to closure across teams, vendors and time zones, and you raise risk before it becomes a missed deadline.
Comfortable being a single point of contact: communicating clear status to managers and working with external security reviewers.
Strong problem-solving, documentation and cross-team communication skills.