About Cake

Cake is a leading digital bank in Vietnam, powered by VPBank. We are building the future of banking with mobile-first financial products across Cards, Payments, Lending, Savings, and Investments.

As a technology-driven, AI-first digital bank, Cake is committed to delivering secure, scalable, and seamless financial experiences to millions of customers. Security is fundamental to protecting customer trust, financial transactions, and critical banking systems.

Role Overview

We are looking for an experienced Head of Security Engineering to lead Cake's security engineering capabilities across our digital banking platform.

As a first-line security leader within Technology, you will drive security strategy and engineering practices across applications, APIs, cloud infrastructure, and critical banking systems, ensuring robust security controls, regulatory compliance, and operational resilience.

The ideal candidate combines deep technical expertise with strong leadership, balancing security, business priorities, and engineering efficiency in a highly regulated banking environment.

Key Responsibilities

1. Security Strategy & Leadership

• Define and execute Cake's security engineering roadmap, aligned with business priorities, technology architecture, and regulatory requirements.
• Lead and develop a high-performing security team, establishing clear accountability, technical standards, and measurable security outcomes.
• Drive security investments, control improvements, and remediation priorities based on risk exposure, business impact, and criticality of banking services.
• Partner with Technology leadership and second-line IT Risk Management to ensure effective security implementation and independent risk oversight.

2. Product & Application Security

• Lead security engineering across mobile banking applications, web platforms, APIs, and third-party integrations.
• Embed threat modeling, secure architecture reviews, secure coding, and automated security testing (SAST, DAST, SCA) into the SDLC and CI/CD pipelines.
• Strengthen authentication, authorization, API protection, transaction security, and sensitive customer data protection across critical banking journeys.
• Establish security requirements and release-readiness controls for critical applications and high-risk production changes.

3. Cloud & Platform Security

• Drive security architecture and controls across GCP, Kubernetes/GKE, cloud-native infrastructure, and production environments.
• Strengthen IAM, privileged access, encryption, key management, secrets management, network security, and container protection.
• Work with Platform Engineering and SRE to implement secure configurations, infrastructure-as-code controls, and continuous cloud security monitoring.
• Ensure technical security controls support the availability, resilience, and protection of critical banking services.

4. Security Engineering, Testing & Remediation

• Lead vulnerability management, penetration testing, attack-surface reduction, and security automation across applications and infrastructure.
• Establish risk-based remediation priorities, clear ownership, SLAs, and technical validation of critical security findings.
• Coordinate security assessments, red/purple team exercises, and control-effectiveness testing where appropriate.
• Track security performance through measurable indicators covering vulnerability exposure, testing coverage, control effectiveness, and remediation progress.

5. Security Incident Response & Technology Risk

• Partner with Cyber Defence, SRE, and Engineering teams to investigate, contain, and remediate security incidents.
• Lead technical root-cause analysis and corrective actions to prevent recurrence.
• Implement security controls and remediation plans within Technology's responsibilities, while supporting independent risk assessment and oversight by IT Risk Management.
• Support security assessments of third-party technology providers, payment integrations, and critical external APIs.

6. Regulatory Security Assessment & Compliance

• Lead the assessment and completion of system classification and security level dossiers for new information systems, in accordance with applicable State Bank of Vietnam (SBV) regulations and internal policies.
• Coordinate with Engineering, IT Operations, System Owners, and relevant stakeholders to collect technical documentation, assess security requirements, and complete required approval and review processes before systems go live, where applicable.
• Ensure security requirements and regulatory obligations are incorporated into system design, implementation, and operational processes.

Requirements

Mandatory Qualifications

• Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related technical field.
• 10+ years of experience in cybersecurity or security engineering, including at least 4–5 years in security leadership or management roles.
• Proven experience securing production systems in banking, digital banking, payments, regulated fintech, or comparable highly regulated financial technology environments.
• Strong expertise in at least two of the following: Application/Product Security, Cloud Security, Security Engineering, or Offensive Security, with a solid understanding of the remaining domains.
• Hands-on experience with secure SDLC, threat modeling, vulnerability management, penetration testing, security architecture, and incident response.
• Strong knowledge of cloud-native security, IAM, privileged access management, encryption, API security, and protection of sensitive financial data.
• Practical understanding of banking security requirements, SBV regulations, and technical controls supporting financial transaction security.
• Proven ability to lead security teams, influence Engineering stakeholders, and drive remediation across complex technology environments.
• Experience working with Risk, Compliance, and Audit functions within a regulated governance framework.

Technical Expertise

• Application & Product Security: OWASP Top 10, API security, mobile application security, secure coding, threat modeling, SAST, DAST, and software composition analysis.
• Cloud & Platform Security: GCP or equivalent public cloud, Kubernetes, IAM, workload identity, secrets management, container security, and CI/CD security.
• Security Engineering: Vulnerability management, security architecture reviews, attack-surface reduction, penetration testing, and security automation.
• Cyber Defence: Security monitoring, incident response, threat detection, and collaboration with SOC or Cyber Defence teams.
• Security Governance: Risk assessment, security policies, compliance frameworks, and third-party security risk management.

Leadership & Soft Skills

• Strong technical judgment, strategic thinking, and problem-solving capabilities.
• Proven ability to build, lead, and develop high-performing security teams.
• Excellent communication, stakeholder management, and cross-functional collaboration.
• Strong ownership, execution discipline, and ability to balance security, regulatory requirements, business continuity, and engineering velocity.

Nice to Have

• Experience securing core banking integrations, card-processing systems, payment platforms, or high-volume transaction APIs.
• Strong hands-on experience with GCP/GKE and cloud-native security technologies.
• Relevant certifications such as CISSP, CCSP, CISM, CSSLP, or OSCP.
• Experience with PCI DSS implementation, AI security, security automation, or red/purple team exercises.