Senior Security Engineer (PenTest) at SAP

Language

Location: Hanoi
Level: senior
Posted: Jul 2, 2026

Summary from listing

GFT Technologies is hiring a Senior Security Engineer to strengthen the security posture of banking applications, APIs, cloud platforms, infrastructure, and digital systems. The role covers security assessments, vulnerability management, penetration testing, secure SDLC activities, remediation support, cloud and infrastructure hardening, compliance evidence, and risk reporting. It requires hands-on security engineering experience across regulated financial services environments, knowledge of banking workflows and OWASP vulnerabilities, and flexibility to work onsite at client locations when required.

Required Skills

Security engineering
Application security
Vulnerability management
Penetration testing
OWASP Top 10
Cloud security
CI/CD security
Burp Suite
Secure coding
Python

Additional Information

Required Previous Experiences: Hands-on security engineering, application security, vulnerability management, and security assessments across web, mobile, API, infrastructure, and cloud environments
Penetration testing, ethical hacking, and vulnerability validation across enterprise applications and platforms
Securing or assessing mobile applications on iOS and Android
Integrating security into engineering and DevOps practices, including CI/CD security, secure configuration, secrets management, and automation
Partnering with engineering teams to validate vulnerabilities, support remediation, and improve secure development practices
Experience working as a Security Engineer, Application Security Engineer, or Penetration Tester within banks, fintechs, payment platforms, or financial institutions
Preferred Qualifications: Knowledge of PCI DSS, ISO 27001, SOC 2, SWIFT CSCF, and other banking or financial services security standards
Experience with secure code review practices and SAST tools
Experience integrating security controls into CI/CD pipelines using SAST, DAST, SCA, container scanning, or secrets detection
Knowledge of container, Kubernetes, Docker, cloud, and Infrastructure-as-Code security
Experience with red teaming, attack simulation, adversary emulation, or purple team exercises
Scripting or automation skills in Python, Bash, or PowerShell
Security certifications such as CEH, eJPT, PNPT, OSCP, GPEN, GWAPT, CISSP, CISM, or equivalent
Translation Company Name: GFT Technologies SE