Senior Officer, Information Security

3 Sept 2025

**Senior Officer, Information Security (Techcom Insurance)**:

- Category: Technology Division
- Job Type:

- Facility: Technology

**Job Purpose**:
The job holder is responsible for building, managing, participating in the development of one of the following areas:
a. IS Practice: Evaluate deployment, develop security solutions/Design, test information security/Ensure compliance with security standards (of Vietnam and International)
b. IS Administration: Manage and directly participate in administrative activities on identity and access security/network security/endpoint services and data security
d. IS Red team: Manage and directly perform testing attack activities for technology systems to detect vulnerabilities/weaknesses and provide solution guidance.
e. IS Monitoring: Monitor detecting all attack events/incidents as quickly as possible (realtime) based on events aggregated from security systems as well as other technology components.Then alert relevant departments to investigate and react to that event/incident.

**Key Accountabilities (1)**:

- 1. Information Security Assurance
- Participate in projects, developing and deploying technology to ensure Information Security for systems to be built, including stages: analysis, building requirements Information security, design Information security, threat modeling, source code review, testing and building controls to ensure Information Security.
- Research and develop necessary information security solutions to prevent attacks and incidents Information security, ensure security and safety for the entire information system of the bank.
- Coordinate with the Information Security supervisory department in handling information security incidents.
- Set up and monitor the implementation of TCB's information security process, regulations, standards, guidelines and policies in accordance with the regulations of the government and international organizations
- Implement and maintain compliance with international standards PCI-DSS, ISO, SWIFT CSP.
- Implement and maintain compliance with TCB's policies, circulars and regulations of the State Bank.
- Regularly perform compliance and integrity checks

of the security policy configuration in the internal system TCB detects violations or insider attacks.
- Coordinate with Compliance Assessment and Risk Management units to assess the compliance of technology systems according to policies, regulations, standards, processes, checklists.

**Key Accountabilities (2)**:

- 2. Information Security Red team:

- Implement the strategy to ensure information security:
+ Participate in the implementation of the Information Security strategy by providing input data on attack trends, forms of exploitation and risks arising in each period.
+ Participate in the implementation of the annual information security implementation plan, meet the business and operational needs of the bank through the implementation of information security testing programs for the technology activities of the bank. Bank.
+ Develop penetration testing methods, information security scanning scripts and security checks according to international standards such as OSSTMM, Sans and OWASP.
+ Develop new techniques, exploit scripts and programs for automated penetration testing
- Perform test attack activities:
+ Perform regular vulnerability scans, information security checks to find vulnerabilities in the system and provide remedial / remedial solutions; supports maintaining compliance with world security standards such as PCI-DSS, ISO27001, SCP (swift).
+ Develop and manage vulnerability management program, threat intelligence database. Collect, track metrics, and analyze trends on cyber defenses, threats, detected attacks, vulnerabilities, and countermeasures/preventions.
+ Actively research / find new vulnerabilities, exploitation techniques and cyber threats; Identify trends in cybersecurity involving tactics, techniques, and processes, targeting for malware development and deployment.
+ Directly participate in the experimental plan of responding to an Information Security incident as an attack unit and in the case of an actual Information Security incident as the response team. Coordinate and provide expert cyber defense engineering skills to resolve cyber attack incidents**Key Accountabilities (3)**:

- 3. Information Security Administration
- Building/adjusting and implementing MTPQ of systems.
- Develop requirements and measures to control access and protect the bank's data.
- Develop, maintain and optimize information security policy/rule/configuration for solutions to ensure information security such as: Information security solutions on access identity management (PAM, IAM ); Network information security solutions (Firewall, NAC, APT, NetIPS, DDOS...); Information Security solutions on endpoints (AD GPO, HIPS/HFW, Appcontrol, Web/mail filtering, DB security ); Information security solutions on data (DLP, FAM...).
- Assess, evaluate, review