Protect a multi-tenant SaaS platform that holds ad-channel tokens, customer data and payment flows: review code, model threats, fix vulnerabilities and raise the security bar for the whole team.
Benefits
- Social, health and unemployment insurance as required by Vietnamese labour law
- Paid annual leave and public holidays under the Labour Code
- A clear labour contract; salary negotiated on ability and stated in your offer letter
- Work on a stack that runs in production: TypeScript, React, Cloudflare Workers, D1, R2, Queues, Durable Objects
- Use AI every day — Claude, Gemini, Workers AI — in the product and in how we work
- Code ships with automated tests and is reviewed before it reaches production
- Equipment, remote work and bonuses: discussed in detail at interview
What you will do
- Run code and architecture reviews in rounds: authorisation, isolation between tenants, authentication, sessions and cookies.
- Harden passkey (WebAuthn) sign-in, session management and access to admin areas.
- Check CSP and CORS, defend against CSRF and SSRF, and verify webhook signatures from platforms and payment gateways.
- Design key rotation, secret storage and token encryption processes.
- Write a test for every vulnerability you fix so it never comes back.
- Coach engineers on secure coding; track vulnerabilities in dependencies.
What we are looking for
- 3+ years in web application security, or software development with a security focus.
- Solid knowledge of the OWASP Top 10 — how to exploit and how to defend in practice.
- Able to read TypeScript/JavaScript and write the fix yourself.
- Understanding of OAuth 2.0, OpenID Connect, WebAuthn and session management.
Nice to have
- OSCP or OSWE certification, or bug bounty experience.
- Familiarity with Vietnam's personal data protection rules.
Hours & location
- Working hours: Office hours; your exact schedule is agreed at interview.
- Location: Ho Chi Minh City, Vietnam — the exact office address is sent with your interview invitation.
- Reports to: Executive Board.
Your application
- Your contact details and a few lines about yourself (required). A CV is optional — if you have one, attach a PDF, DOC, DOCX, JPG or PNG up to 10 MB.
- A link to your GitHub, portfolio or something you have built — one real project says more than a page of CV.
- If you can: measurable results from your work (revenue, customers looked after, campaigns, articles) — add them to your introduction.
- Degrees and certificates (if any) — only needed when you join, no need to send them in advance.
- SOZO never charges candidates any fee and never asks for photos of your ID over social media.
Hiring process
See details- Step 1:Apply
- Step 2:Screening & chat
- Step 3:Interview
- Step 4:Offer