ZALORA Vietnam

Overview of job

ABOUT THE ROLE

Zalora is looking for a Junior Security Engineer to join its security team and support day-to-day security operations under the guidance of the Senior Security Lead. This is a hands-on, learning-oriented role: you’ll help execute security reviews, monitor and triage findings, support incident response, and assist with hardening cloud and application environments. You’ll work closely with the Senior Security Lead and Zalora engineering teams to build your skills across cloud security, application security, and AI/LLM security, while contributing directly to Zalora’s security posture.

Responsibilities

Security Operations & Monitoring

• Monitor security alerts, logs, and dashboards; triage and escalate findings to the Senior Security Lead as needed.
• Support day-to-day cloud security hygiene checks (primarily AWS, also GCP) — e.g., IAM reviews, misconfiguration checks, and basic remediation.
• Help maintain security tooling and automation scripts used across the team.

Application & Infrastructure Security Support

• Assist with security architecture reviews for new and existing systems under senior guidance.
• Run and interpret basic SAST/DAST scans, and help track findings through to remediation with engineering teams.
• Support secure configuration of containerized environments (Docker).
• Assist, where opportunities arise, with Kubernetes/CI-CD pipeline security and reviewing AI-driven features or LLM integrations for common risks (e.g., prompt injection, data leakage) under senior guidance — exposure to this work will grow over time, not expected on day one.

Incident Response & Testing Support

• Support incident response activities — gathering logs, documenting timelines, and assisting with remediation tasks under the direction of the Senior Security Lead.
• Assist with penetration testing and red-team exercises (internal or vendor-led), including evidence collection and findings tracking.
• Coordinate logistics with external vendors and consultants when supporting pentesting or peak-demand engagements.

Collaboration & Growth

• Work with engineering teams to communicate security findings clearly and help get fixes prioritized.
• Take on structured learning goals (certifications, tooling, frameworks) with support and mentorship from the Senior Security Lead.
• Document processes, runbooks, and findings to build the team’s institutional knowledge.

• The unique opportunity to have a serious impact on a growing organization
• A dynamic working environment shaping the face of fashion e-commerce in growth markets
• Work closely with a global talent pool with international mindset 
• Best practice scaled agile engineering
• Amazing office and great culture! Massage chairs, table tennis, video game room, quarterly team events, yearly company trip, end of the year party
• Hybrid working environment.
• Clear career progression plan and support
• Macbook or laptop when you start
• Social insurance, medical insurance & health insurance
• 13th month salary
• 15 days of annual leave, 30 days of sick leave/mental health, 1 day of occasion leave

General qualifications

• 1–2 years of experience in security engineering, IT, software engineering, or a related technical field (internships and hands-on personal/academic projects count).
• Genuine interest in security engineering and a desire to grow into a hands-on technical role.
• Able to communicate findings clearly in writing, and comfortable asking questions and seeking guidance.
• Degree or equivalent practical experience in Computer Science, Information Security, or a related field; relevant certifications (e.g., Security+, eJPT) are a plus, not required.

Technical Skills

• Basic understanding of cloud fundamentals (AWS preferred; GCP a plus) — IAM, networking, and common services.
• Familiarity with at least one scripting/programming language (e.g., Python, Bash, Go) for automation tasks.
• Exposure to or coursework in application security concepts (OWASP Top 10, common vulnerability classes).
• Basic familiarity with containerized environments (Docker) and version control (Git); Kubernetes exposure is a plus.
• Curiosity about AI/LLM security concepts is a plus — prior experience not required.

Team & Collaboration

• Comfortable working under supervision, taking direction, and escalating issues appropriately rather than guessing under pressure.
• Willing to learn Zalora’s and GFG’s security standards and apply them consistently in day-to-day work.
• Able to work collaboratively with engineering teams across time zones and markets.