Trách nhiệm chính

• Lead, mentor, and grow Zalora’s security team — set priorities, review work, and develop team members’ skills
• Own hiring and resourcing input for the team, including when to bring in external specialist consultants versus building in‑house capability
• Act as the primary point of contact between security and Zalora business/engineering leadership, translating security risk into business terms and negotiating trade‑offs
• Represent Zalora’s security posture and priorities in group‑level conversations with the Global CISO organization
• Execute security architecture reviews for new and existing systems, and validate cloud security posture (primarily AWS, also GCP)
• Implement and maintain IAM strategies, zero trust controls, and infrastructure‑as‑code security
• Integrate security automation into CI/CD pipelines and DevSecOps workflows
• Secure containerised environments (Docker, Kubernetes)
• Run threat modelling, SAST/DAST, and mobile application security testing on key systems
• Review AI‑driven features and LLM integrations for risks such as prompt injection, data leakage, and supply chain vulnerabilities, and recommend concrete mitigations
• Apply existing AI/LLM security standards (e.g., OWASP Top 10 for LLM Applications) to real reviews, rather than authoring group‑wide policy
• Act as the senior technical escalation point during active incidents, leading technical response and remediation
• Run penetration testing and red‑team exercises (internally or via external consultants), and track findings through to fix
• Manage relationships with external vendors and specialist consultants for pentesting, AI security, and peak‑demand coverage

Yêu cầu

• 7–10+ years of hands‑on experience in security engineering, product security, or infrastructure security (not purely strategy/GRC roles)
• Comfortable being the technical decision‑maker under pressure — e.g., during a live incident or a contested architecture review
• Able to explain a technical finding (e.g., a vulnerability or misconfiguration) clearly to a non‑technical stakeholder
• Experience leading or building a security team — direct people‑management experience preferred, technical/task leadership of a team at minimum
• Strong, hands‑on AWS security experience (IAM, network security, security services); working knowledge of GCP
• Practical experience with SAST/DAST tooling, threat modeling, and mobile application security testing
• Working knowledge of AI/ML security risks and frameworks (OWASP Top 10 for LLM Applications, NIST AI RMF), with real experience reviewing LLM‑integrated features or third‑party AI tools
• Experience securing containerized environments (Docker, Kubernetes) and CI/CD pipelines
• Comfortable running or supporting penetration tests and red‑team exercises, including remediation follow‑through

Yêu cầu ưu tiên

• Experience in fashion or retail e‑commerce is a plus, not required
• Track record of giving technical guidance and unblocking engineers day‑to‑day, as well as managing team performance and development — not just high‑level mentorship
• Able to work with engineering and business stakeholders, including senior leadership, to get security fixes prioritised, shipped, and communicated in business terms
• Comfortable balancing GFG group‑level security standards with Zalora’s local regulatory needs across its markets

Mức lương

• Thỏa thuận

Thông tin khác

• ZALORA is Asia’s leading online fashion, beauty and lifestyle destination, part of Global Fashion Group
• The role is based at 12 Ton Dan, Xom Chieu Ward, Thành phố Hồ Chí Minh
• ZALORA is part of Global Fashion Group, the world's leader in online fashion for emerging markets