IT Security & Compliance Specialist

UrBox is Vietnam’s leading digital gifting & loyalty platform that enables businesses to integrate their reward & loyalty programs with an ever-growing network of more than 350 brands & 20,000 accepted online and offline stores in Vietnam.

UrBox has the widest network of clients in loyalty in Vietnam and provides loyalty & reward solutions to many big organizations in the aviation, banking, FMCG, Insurance, Real Estate industries and more.

The IT Security & Compliance Specialist will be the guardian of UrBox’s technical integrity. You will lead the efforts to achieve PCI-DSS SAQ-D compliance, harden our PostgreSQL databases, and secure our MLOps pipelines. Your mission is to proactively identify vulnerabilities and architect robust fraud detection mechanisms across our operations.

• Compliance & Audit: Lead the technical implementation and documentation for PCI-DSS SAQ-D certification by Q1 2026. Conduct regular internal audits to ensure continuous compliance.
• Database & Infrastructure Hardening: Secure PostgreSQL environments using RBAC, Row-Level Security (RLS), and audit logging. Ensure high-level encryption for sensitive data.
• MLOps Security: Integrate security checkpoints into the AI/ML lifecycle. Protect ML models and data pipelines from poisoning, inversion attacks, and unauthorized access.
• Vulnerability Management: Perform regular VAPT (Web, Mobile, Cloud) and Secure Code Reviews to identify and mitigate risks early in the SDLC.
• Fraud Detection & IR: Build automated monitoring systems (SIEM/IDS) to detect transaction fraud and operational anomalies. Lead the Incident Response team when breaches occur.

• Graduated from University in Information Technology.
• Cyber Security, Information Security, Computer Science, Software Engineering, or equivalent.
• Able to read and understand technical English documents and security standards.
• Experience: 3–5 years in Cyber Security, preferably in Fintech or E-commerce.
• Database Expertise: Strong hands-on experience with PostgreSQL security configurations and performance monitoring from a security perspective.
• ML & Cloud Skills: Knowledge of securing AWS/GCP environments and MLOps frameworks. Experience with Docker/K8s security is a major plus.
• Tools: Proficient with Burp Suite, Nessus, Metasploit, and SQL injection testing tools.
• Compliance Knowledge: Deep understanding of PCI-DSS, ISO 27001, or SOC2 frameworks.