DevOps Engineer

OPSWAT

Ho Chi Minh City, Ho Chi Minh, Vietnam

Published: 6/14/2022

Full Time

<div class="content-intro">OPSWAT, a global leader in IT, OT, and ICS critical infrastructure cybersecurity, delivers an end-to-end platform that gives public and private sector organizations and enterprises the critical advantage needed to protect their complex networks, secure their devices, and ensure compliance. Over the last 20 years our commitment to innovative technology has earned the trust of more than 1,700 organizations, governments, and institutions globally, solidifying our role in protecting the world’s critical infrastructure and securing our way of life.</div>The Position
 
<ul class="ak-ul" data-local-id="e1fae2e3278e" data-indent-level="1">
<li>
Join the infrastructure team behind MDaaS — a real-time malware scanning platform handling 30M+ requests/day, built on AWS, Kubernetes, and event streaming.
</li>
<li>
You'll work in an agile scrum team, owning infrastructure-as-code, CI/CD pipelines, and observability. Security and compliance are first-class requirements, not afterthoughts.
</li>
</ul>
What You Will be Doing
 
<ul class="ak-ul" data-local-id="3eed5d16cfad" data-indent-level="1">
<li>
Deploy and maintain workloads on EKS via ArgoCD — review GitOps PRs, handle sync failures, approve image updates
</li>
<li>
Write and update Helm charts / Kustomize overlays across dev / staging / prod
</li>
<li>
Triage alerts from Prometheus / Grafana / Coralogix — root cause analysis, resolve or escalate
</li>
<li>
Review and apply Terraform changes — plan, validate, and merge infra PRs (EKS, MSK, ALB, IAM)
</li>
<li>
Maintain CI/CD pipelines on Bitbucket Pipelines and GitHub Actions — fix broken builds, integrate security scans
</li>
<li>
Configure and tune KEDA ScaledObjects for Kafka / RabbitMQ consumers
</li>
<li>
Triage CVEs from Blackduck / Trivy reports — prioritize CVSS ≥ 7.0, coordinate patches with dev team
</li>
<li>
Rotate secrets, verify External Secrets Operator sync, enforce no-hardcoded-credentials policy
</li>
<li>
Document infrastructure and application changes for engineers and QA
</li>
<li>
Participate in on-call rotation — incident response, post-mortems, runbook updates
</li>
<li>
Research new tools and technologies to address current pain points and improve system reliability, scalability, and security — evaluate, prototype, and propose adoption when appropriate
</li>
</ul>
 
What We Need From You
 
Education & Background
<ul class="ak-ul" data-local-id="b8cbf1d44655" data-indent-level="1">
<li>
BA/BS in Computer Science, Engineering, or equivalent hands-on experience
</li>
</ul>
Soft Skills
<ul class="ak-ul" data-local-id="27a75f24be9f" data-indent-level="1">
<li>
Strong verbal and written communication in English
</li>
<li>
Self-motivated; works well in a fast-paced, collaborative team
</li>
<li>
Eager to learn new tools and apply them quickly
</li>
<li>
Passionate about solving problems in a principled, elegant way
</li>
<li>
Comfortable both teaching and learning from teammates
</li>
</ul>
Cloud & Infra
<ul class="ak-ul" data-local-id="96ea53da65fa" data-indent-level="1">
<li>
AWS hands-on: EKS, ECR, IAM/IRSA, MSK, S3, ALB, VPC, Security Groups
</li>
<li>
Terraform: write modules, manage remote state, integrate with CI
</li>
<li>
Kubernetes: RBAC, ingress, network policies, HPA, resource tuning — cluster management via Rancher or K9s
</li>
<li>
Helm + Ansible: author charts and playbooks, manage versioning
</li>
<li>
Docker: multi-stage builds, image optimization
</li>
<li>
Linux/Windows systems administration
</li>
</ul>
CI/CD & GitOps
<ul class="ak-ul" data-local-id="e17f40d610ba" data-indent-level="1">
<li>
Bitbucket Pipelines, GitHub Actions, or TeamCity — write and maintain, not just use
</li>
<li>
ArgoCD: sync policy, health checks, rollback
</li>
<li>
PR-based deployments; no direct commits to main/prod
</li>
</ul>
Observability
<ul class="ak-ul" data-local-id="f00f68d78af3" data-indent-level="1">
<li>
Prometheus, Grafana, CloudWatch, Elasticsearch — setup and maintain
</li>
<li>
Structured logging, alert routing, dashboard authoring
</li>
</ul>
Security
<ul class="ak-ul" data-local-id="110d050ada4a" data-indent-level="1">
<li>
Least privilege: IAM, IRSA, K8s RBAC — no wildcard permissions
</li>
<li>
Secret management: External Secrets / AWS Secrets Manager, zero hardcoded credentials
</li>
<li>
Supply chain: dependency scanning (Blackduck / Snyk / Trivy), CVE triage by CVSS score
</li>
<li>
Network segmentation: private subnets, Security Groups, ingress/egress control
</li>
<li>
Working knowledge of ISO/IEC 27001 and SOC 2 Type II — access control, audit trail, change management
</li>
<li>
Familiar with CIS Benchmarks for Kubernetes and Linux hardening
</li>
</ul>
Development
<ul class="ak-ul" data-local-id="232dcd9d9475" data-indent-level="1">
<li>
Python and/or Go — scripting, tooling, automation
</li>
<li>
Able to read Node.js/TypeScript code to debug service issues independently
</li>
</ul>
AI & Tooling
<ul class="ak-ul" data-local-id="f8734fad7fef" data-indent-level="1">
<li>
Actively uses AI coding tools (GitHub Copilot, Cursor, Claude) in daily workflow — writing scripts, Terraform modules, Helm templates, and debugging
</li>
<li>
Knows how to prompt effectively, verify AI output, and not blindly trust generated infrastructure code
</li>
</ul>
Nice-to-have
<ul class="ak-ul" data-local-id="7ffc9dba49c6" data-indent-level="1">
<li>
Experience in the cybersecurity industry
</li>
<li>
Knowledge of compliance frameworks: NIST CSF, HIPAA, GDPR — applied to real infrastructure
</li>
<li>
Istio: mTLS, VirtualService/DestinationRule, traffic management
</li>
<li>
KEDA advanced: custom metrics, scale-to-zero, cooldown tuning
</li>
<li>
Kafka (MSK) operations: topic management, consumer lag, AKHQ
</li>
<li>
Policy-as-code: OPA/Gatekeeper or Kyverno
</li>
<li>
OWASP container and API security principles
</li>
<li>
Coralogix / Datadog with OpenTelemetry — custom pipelines, alert routing
</li>
<li>
Kubecost cost analysis, Kubeshark traffic capture
</li>
<li>
Experience with large-scale systems: 30M+ requests/day
</li>
<li>
Azure exposure (secondary to AWS)
</li>
<li>
Has used AI to generate, review, or optimize infrastructure-as-code (Terraform, Helm, bash scripts) and understands its limitations: hallucinations, outdated API references, security blind spots
</li>
<li>
Experimented with AI APIs (OpenAI, Anthropic) to build internal automation or tooling
</li>
</ul>
 
 <div class="content-conclusion">OPSWAT is an equal opportunity employer. We celebrate diversity and are committed to providing an environment where equal employment opportunities are extended to all employees and applicants, free of discrimination and harassment of any type. All employment decisions are based on individual qualifications, job requirements, and business needs without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other category protected by federal, state, or local laws.
Recruiting Agencies: we do not accept unsolicited resumes from third party agencies for any of our open positions. To submit resumes for our jobs, there must be a recruiting contract approved by our legal team and endorsed by both parties. We are currently not accepting additional 3rd party agencies at this time.
 </div>