{"id":15592,"date":"2026-08-24T16:22:06","date_gmt":"2026-08-24T09:22:06","guid":{"rendered":"https:\/\/galaxyholdings.co\/?post_type=job&#038;p=15592"},"modified":"2026-08-24T16:22:06","modified_gmt":"2026-08-24T09:22:06","slug":"chuyen-vien-cao-cap-danh-gia-bao-mat-ung-dung-di-dong","status":"publish","type":"job","link":"https:\/\/galaxyholdings.co\/en\/job\/chuyen-vien-cao-cap-danh-gia-bao-mat-ung-dung-di-dong\/","title":{"rendered":"Chuy\u00ean vi\u00ean cao c\u1ea5p \u0110\u00e1nh gi\u00e1 B\u1ea3o m\u1eadt \u1ee8ng d\u1ee5ng Di \u0111\u1ed9ng"},"content":{"rendered":"<p><span style=\"font-size: 18pt; color: #0000ff;\"><strong>T\u1ed5ng quan v\u1ecb tr\u00ed:<\/strong><\/span><\/p>\n<ul>\n<li>Tr\u1ef1c ti\u1ebfp th\u1ef1c hi\u1ec7n ki\u1ec3m th\u1eed x\u00e2m nh\u1eadp chuy\u00ean s\u00e2u \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng Android v\u00e0 iOS (bao g\u1ed3m \u1ee9ng d\u1ee5ng native, Flutter, React Native) c\u00f9ng to\u00e0n b\u1ed9 API backend ph\u1ee5c v\u1ee5 \u1ee9ng d\u1ee5ng.<\/li>\n<li>Th\u1ef1c hi\u1ec7n d\u1ecbch ng\u01b0\u1ee3c (reverse engineering) v\u00e0 ph\u00e2n t\u00edch \u0111\u1ed9ng: v\u01b0\u1ee3t c\u01a1 ch\u1ebf ph\u00e1t hi\u1ec7n root\/jailbreak, SSL pinning, ch\u1ed1ng can thi\u1ec7p (anti-tampering\/RASP) \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 th\u1ef1c ch\u1ea5t kh\u1ea3 n\u0103ng ch\u1ed1ng ch\u1ecbu c\u1ee7a \u1ee9ng d\u1ee5ng.<\/li>\n<li>\u0110\u00e1nh gi\u00e1 an to\u00e0n cho c\u00e1c lu\u1ed3ng nghi\u1ec7p v\u1ee5 tr\u1ecdng y\u1ebfu tr\u00ean di \u0111\u1ed9ng: thanh to\u00e1n, eKYC\/x\u00e1c th\u1ef1c sinh tr\u1eafc h\u1ecdc, ch\u1eef k\u00fd s\u1ed1, tokenization v\u00e0 l\u01b0u tr\u1eef d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m tr\u00ean thi\u1ebft b\u1ecb.<\/li>\n<li>Khai th\u00e1c v\u00e0 ch\u1ee9ng minh l\u1ed7 h\u1ed5ng b\u1eb1ng PoC c\u00f3 ki\u1ec3m so\u00e1t; x\u1ebfp h\u1ea1ng r\u1ee7i ro theo t\u00e1c \u0111\u1ed9ng nghi\u1ec7p v\u1ee5 v\u00e0 th\u1ef1c hi\u1ec7n retest x\u00e1c nh\u1eadn kh\u1eafc ph\u1ee5c.<\/li>\n<li>Nghi\u00ean c\u1ee9u k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng v\u00e0 m\u00e3 \u0111\u1ed9c di \u0111\u1ed9ng m\u1edbi; ph\u00e1t tri\u1ec3n c\u00f4ng c\u1ee5, script t\u1ef1 \u0111\u1ed9ng h\u00f3a ph\u1ee5c v\u1ee5 ki\u1ec3m th\u1eed li\u00ean t\u1ee5c v\u00e0 t\u00edch h\u1ee3p v\u00e0o quy tr\u00ecnh ph\u00e1t h\u00e0nh \u1ee9ng d\u1ee5ng.<\/li>\n<li>T\u01b0 v\u1ea5n k\u1ef9 thu\u1eadt cho \u0111\u1ed9i ph\u00e1t tri\u1ec3n di \u0111\u1ed9ng v\u1ec1 nguy\u00ean nh\u00e2n g\u1ed1c v\u00e0 gi\u1ea3i ph\u00e1p kh\u1eafc ph\u1ee5c; h\u1ed7 tr\u1ee3 Blue Team\/SOC x\u00e2y d\u1ef1ng n\u0103ng l\u1ef1c ph\u00e1t hi\u1ec7n t\u1ea5n c\u00f4ng nh\u1eafm v\u00e0o ng\u01b0\u1eddi d\u00f9ng di \u0111\u1ed9ng.<\/li>\n<\/ul>\n<p><span style=\"font-size: 18pt; color: #0000ff;\"><strong>M\u00f4 t\u1ea3 c\u00f4ng vi\u1ec7c:<\/strong><\/span><\/p>\n<ol>\n<li><strong> Ki\u1ec3m th\u1eed x\u00e2m nh\u1eadp \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng Android v\u00e0 iOS<\/strong><\/li>\n<\/ol>\n<ul>\n<li>Th\u1ef1c hi\u1ec7n ki\u1ec3m th\u1eed theo chu\u1ea9n OWASP MASVS\/MASTG tr\u00ean c\u1ea3 hai n\u1ec1n t\u1ea3ng: ph\u00e2n t\u00edch t\u0129nh (jadx, apktool, Ghidra\/IDA, MobSF) v\u00e0 ph\u00e2n t\u00edch \u0111\u1ed9ng (Frida, objection, r2frida, Burp Suite).<\/li>\n<li>Ki\u1ec3m th\u1eed l\u01b0u tr\u1eef d\u1eef li\u1ec7u tr\u00ean thi\u1ebft b\u1ecb: Keychain\/Keystore, c\u01a1 s\u1edf d\u1eef li\u1ec7u c\u1ee5c b\u1ed9, t\u1ec7p cache, log, sao l\u01b0u, d\u1eef li\u1ec7u t\u1ed3n d\u01b0 trong b\u1ed9 nh\u1edb v\u00e0 \u1ea3nh ch\u1ee5p m\u00e0n h\u00ecnh n\u1ec1n.<\/li>\n<li>Ki\u1ec3m th\u1eed c\u01a1 ch\u1ebf m\u1eadt m\u00e3: thu\u1eadt to\u00e1n y\u1ebfu, kh\u00f3a c\u1ee9ng trong m\u00e3 ngu\u1ed3n, sinh kh\u00f3a kh\u00f4ng an to\u00e0n, s\u1eed d\u1ee5ng sai IV\/salt, qu\u1ea3n l\u00fd v\u00f2ng \u0111\u1eddi kh\u00f3a.<\/li>\n<li>Ki\u1ec3m th\u1eed giao ti\u1ebfp li\u00ean ti\u1ebfn tr\u00ecnh v\u00e0 b\u1ec1 m\u1eb7t t\u1ea5n c\u00f4ng c\u1ee7a n\u1ec1n t\u1ea3ng: deep link\/App Link\/Universal Link, intent redirection, component b\u1ecb export, custom URL scheme, l\u1ed7 h\u1ed5ng WebView v\u00e0 JavaScript bridge.<\/li>\n<li>\u0110\u00e1nh gi\u00e1 c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 \u1ee9ng d\u1ee5ng: ph\u00e1t hi\u1ec7n root\/jailbreak, SSL pinning, ch\u1ed1ng debug, l\u00e0m r\u1ed1i m\u00e3, RASP, Play Integrity API v\u00e0 App Attest \u2013 x\u00e1c \u0111\u1ecbnh kh\u1ea3 n\u0103ng v\u01b0\u1ee3t qua tr\u00ean th\u1ef1c t\u1ebf.<\/li>\n<\/ul>\n<ol start=\"2\">\n<li><strong> Ki\u1ec3m th\u1eed API backend v\u00e0 c\u00e1c lu\u1ed3ng nghi\u1ec7p v\u1ee5 tr\u1ecdng y\u1ebfu<\/strong><\/li>\n<\/ol>\n<ul>\n<li>Ki\u1ec3m th\u1eed API ph\u1ee5c v\u1ee5 \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng theo OWASP API Security Top 10: BOLA\/IDOR, l\u1ed7i ph\u00e2n quy\u1ec1n, l\u1ea1m d\u1ee5ng h\u1ea1n m\u1ee9c, l\u1ed9 d\u1eef li\u1ec7u qu\u00e1 m\u1ee9c.<\/li>\n<li>Ki\u1ec3m th\u1eed x\u00e1c th\u1ef1c v\u00e0 qu\u1ea3n l\u00fd phi\u00ean: OAuth 2.0\/OIDC, JWT, refresh token, device binding, x\u00e1c th\u1ef1c sinh tr\u1eafc h\u1ecdc (BiometricPrompt\/Face ID) v\u00e0 kh\u1ea3 n\u0103ng v\u01b0\u1ee3t qua \u1edf l\u1edbp client.<\/li>\n<li>Ki\u1ec3m th\u1eed lu\u1ed3ng thanh to\u00e1n v\u00e0 \u0111\u1ecbnh danh: tokenization, HCE\/NFC, giao d\u1ecbch tr\u1ef1c tuy\u1ebfn, eKYC \u2013 bao g\u1ed3m th\u1eed nghi\u1ec7m v\u01b0\u1ee3t ki\u1ec3m tra liveness b\u1eb1ng \u1ea3nh, video v\u00e0 n\u1ed9i dung t\u1ed5ng h\u1ee3p b\u1eb1ng AI (deepfake).<\/li>\n<li>Ki\u1ec3m th\u1eed l\u1ed7i logic nghi\u1ec7p v\u1ee5 \u0111\u1eb7c th\u00f9 di \u0111\u1ed9ng: race condition khi giao d\u1ecbch, thao t\u00fang tham s\u1ed1 ph\u00eda client, ph\u00e1t l\u1ea1i y\u00eau c\u1ea7u (replay), l\u1ea1m d\u1ee5ng lu\u1ed3ng kh\u00f4i ph\u1ee5c t\u00e0i kho\u1ea3n.<\/li>\n<\/ul>\n<ol start=\"3\">\n<li><strong> \u0110\u00e1nh gi\u00e1 r\u1ee7i ro n\u1ec1n t\u1ea3ng, SDK b\u00ean th\u1ee9 ba v\u00e0 quy\u1ec1n ri\u00eang t\u01b0<\/strong><\/li>\n<\/ol>\n<ul>\n<li>R\u00e0 so\u00e1t SDK\/th\u01b0 vi\u1ec7n b\u00ean th\u1ee9 ba t\u00edch h\u1ee3p trong \u1ee9ng d\u1ee5ng: l\u1ed7 h\u1ed5ng \u0111\u00e3 c\u00f4ng b\u1ed1, h\u00e0nh vi thu th\u1eadp d\u1eef li\u1ec7u ngo\u00e0i ph\u1ea1m vi c\u00f4ng b\u1ed1, r\u1ee7i ro chu\u1ed7i cung \u1ee9ng v\u00e0 qu\u1ea3n l\u00fd SBOM cho \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng.<\/li>\n<li>\u0110\u00e1nh gi\u00e1 vi\u1ec7c xin v\u00e0 s\u1eed d\u1ee5ng quy\u1ec1n (permission), r\u00f2 r\u1ec9 d\u1eef li\u1ec7u c\u00e1 nh\u00e2n sang b\u00ean th\u1ee9 ba, t\u00ednh ch\u00ednh x\u00e1c c\u1ee7a Google Play Data Safety v\u00e0 Apple Privacy Manifest.<\/li>\n<li>\u0110\u1ed1i chi\u1ebfu tu\u00e2n th\u1ee7 Lu\u1eadt B\u1ea3o v\u1ec7 d\u1eef li\u1ec7u c\u00e1 nh\u00e2n s\u1ed1 91\/2025\/QH15 v\u00e0 c\u00e1c quy \u0111\u1ecbnh chuy\u00ean ng\u00e0nh \u00e1p d\u1ee5ng cho \u1ee9ng d\u1ee5ng giao d\u1ecbch \u0111i\u1ec7n t\u1eed.<\/li>\n<li>\u0110\u00e1nh gi\u00e1 \u1ee9ng d\u1ee5ng t\u00edch h\u1ee3p AI\/LLM v\u00e0 m\u00f4 h\u00ecnh ch\u1ea1y tr\u00ean thi\u1ebft b\u1ecb (on-device model): tr\u00edch xu\u1ea5t m\u00f4 h\u00ecnh, prompt injection qua d\u1eef li\u1ec7u \u0111\u1ea7u v\u00e0o, r\u00f2 r\u1ec9 d\u1eef li\u1ec7u qua SDK AI.<\/li>\n<\/ul>\n<ol start=\"4\">\n<li><strong> Nghi\u00ean c\u1ee9u, ph\u00e1t tri\u1ec3n c\u00f4ng c\u1ee5 v\u00e0 t\u1ef1 \u0111\u1ed9ng h\u00f3a ki\u1ec3m th\u1eed<\/strong><\/li>\n<\/ol>\n<ul>\n<li>Theo d\u00f5i v\u00e0 ph\u00e2n t\u00edch k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng, m\u00e3 \u0111\u1ed9c ng\u00e2n h\u00e0ng tr\u00ean di \u0111\u1ed9ng (overlay, l\u1ea1m d\u1ee5ng Accessibility Service, \u0111\u00e1nh c\u1eafp d\u1eef li\u1ec7u sinh tr\u1eafc h\u1ecdc) v\u00e0 \u0111\u00e1nh gi\u00e1 m\u1ee9c \u0111\u1ed9 \u1ea3nh h\u01b0\u1edfng t\u1edbi \u1ee9ng d\u1ee5ng c\u1ee7a T\u1eadp \u0111o\u00e0n.<\/li>\n<li>Vi\u1ebft PoC\/m\u00e3 khai th\u00e1c cho l\u1ed7 h\u1ed5ng \u0111\u00e3 c\u00f4ng b\u1ed1 v\u00e0 l\u1ed7 h\u1ed5ng t\u1ef1 ph\u00e1t hi\u1ec7n; nghi\u00ean c\u1ee9u l\u1ed7 h\u1ed5ng tr\u00ean framework v\u00e0 SDK m\u00e3 ngu\u1ed3n m\u1edf \u0111ang s\u1eed d\u1ee5ng.<\/li>\n<li>Ph\u00e1t tri\u1ec3n script Frida, c\u00f4ng c\u1ee5 n\u1ed9i b\u1ed9 (Python\/Bash) v\u00e0 m\u1edf r\u1ed9ng c\u00f4ng c\u1ee5 s\u1eb5n c\u00f3 nh\u1eb1m r\u00fat ng\u1eafn th\u1eddi gian ki\u1ec3m th\u1eed.<\/li>\n<li>Tham gia t\u00edch h\u1ee3p ki\u1ec3m th\u1eed b\u1ea3o m\u1eadt v\u00e0o pipeline CI\/CD c\u1ee7a \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng (SAST\/SCA\/MobSF qu\u00e9t t\u1ef1 \u0111\u1ed9ng tr\u00ean m\u1ed7i b\u1ea3n build), tinh ch\u1ec9nh rule \u0111\u1ec3 gi\u1ea3m c\u1ea3nh b\u00e1o sai.<\/li>\n<li>Qu\u1ea3n tr\u1ecb, sao l\u01b0u v\u00e0 n\u00e2ng c\u1ea5p h\u1ea1 t\u1ea7ng lab ki\u1ec3m th\u1eed di \u0111\u1ed9ng: thi\u1ebft b\u1ecb th\u1eadt \u0111\u00e3 root\/jailbreak, thi\u1ebft b\u1ecb gi\u1ea3 l\u1eadp v\u00e0 n\u1ec1n t\u1ea3ng \u1ea3o h\u00f3a.<\/li>\n<\/ul>\n<ol start=\"5\">\n<li><strong> B\u00e1o c\u00e1o, t\u01b0 v\u1ea5n kh\u1eafc ph\u1ee5c v\u00e0 ph\u1ed1i h\u1ee3p ph\u00f2ng th\u1ee7<\/strong><\/li>\n<\/ol>\n<ul>\n<li>So\u1ea1n b\u00e1o c\u00e1o ki\u1ec3m th\u1eed song ng\u1eef Vi\u1ec7t \u2013 Anh: m\u00f4 t\u1ea3 k\u1ef9 thu\u1eadt, b\u1eb1ng ch\u1ee9ng khai th\u00e1c, x\u1ebfp h\u1ea1ng theo CVSS 4.0 g\u1eafn v\u1edbi t\u00e1c \u0111\u1ed9ng nghi\u1ec7p v\u1ee5 v\u00e0 khuy\u1ebfn ngh\u1ecb kh\u1eafc ph\u1ee5c kh\u1ea3 thi.<\/li>\n<li>Tr\u00ecnh b\u00e0y k\u1ebft qu\u1ea3 cho \u0111\u1ed9i ph\u00e1t tri\u1ec3n di \u0111\u1ed9ng v\u00e0 c\u00e1c b\u00ean li\u00ean quan; t\u01b0 v\u1ea5n nguy\u00ean nh\u00e2n g\u1ed1c, secure coding v\u00e0 ki\u1ec3m so\u00e1t b\u00f9 \u0111\u1eafp khi ch\u01b0a th\u1ec3 v\u00e1 ngay.<\/li>\n<li>Chuy\u1ec3n k\u1ecbch b\u1ea3n khai th\u00e1c th\u00e0nh y\u00eau c\u1ea7u ph\u00e1t hi\u1ec7n cho Blue Team\/SOC; h\u1ed7 tr\u1ee3 \u0111\u00e1nh gi\u00e1 hi\u1ec7u qu\u1ea3 c\u1ee7a gi\u1ea3i ph\u00e1p b\u1ea3o v\u1ec7 \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng (MTD\/RASP).<\/li>\n<li>Theo d\u00f5i ti\u1ebfn \u0111\u1ed9 kh\u1eafc ph\u1ee5c v\u00e0 th\u1ef1c hi\u1ec7n retest x\u00e1c nh\u1eadn (Remediation Verification) tr\u01b0\u1edbc khi ph\u00e1t h\u00e0nh phi\u00ean b\u1ea3n m\u1edbi l\u00ean App Store\/Google Play.<\/li>\n<\/ul>\n<ol start=\"6\">\n<li><strong> Chu\u1ea9n h\u00f3a ph\u01b0\u01a1ng ph\u00e1p lu\u1eadn v\u00e0 chia s\u1ebb tri th\u1ee9c<\/strong><\/li>\n<\/ol>\n<ul>\n<li>Bi\u00ean so\u1ea1n, r\u00e0 so\u00e1t \u0111\u1ecbnh k\u1ef3 quy tr\u00ecnh, quy \u0111\u1ecbnh, checklist ki\u1ec3m th\u1eed v\u00e0 m\u1eabu b\u00e1o c\u00e1o cho m\u1ea3ng \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng.<\/li>\n<li>H\u01b0\u1edbng d\u1eabn k\u1ef9 thu\u1eadt v\u00e0 review k\u1ebft qu\u1ea3 c\u1ee7a chuy\u00ean vi\u00ean c\u1ea5p th\u1ea5p h\u01a1n.<\/li>\n<li>T\u1ed5 ch\u1ee9c chia s\u1ebb n\u1ed9i b\u1ed9 v\u1ec1 k\u1ef9 thu\u1eadt t\u1ea5n c\u00f4ng m\u1edbi; \u0111\u00f3ng g\u00f3p n\u1ed9i dung \u0111\u00e0o t\u1ea1o secure coding cho \u0111\u1ed9i ph\u00e1t tri\u1ec3n di \u0111\u1ed9ng.<\/li>\n<li>Tham gia x\u1eed l\u00fd s\u1ef1 c\u1ed1 m\u1ee9c chuy\u00ean s\u00e2u v\u00e0 c\u00e1c \u0111\u1ee3t \u0111\u00e1nh gi\u00e1 \u0111\u1ed9t xu\u1ea5t khi c\u00f3 y\u00eau c\u1ea7u.<\/li>\n<\/ul>\n<p class=\"isSelectedEnd\"><span style=\"font-size: 18pt; color: #0000ff;\"><strong>Y\u00eau c\u1ea7u c\u00f4ng vi\u1ec7c:<\/strong><\/span><\/p>\n<p><strong>Y\u00eau c\u1ea7u b\u1eaft bu\u1ed9c:<\/strong><\/p>\n<ul>\n<li>\u0110\u1ea1i h\u1ecdc tr\u1edf l\u00ean chuy\u00ean ng\u00e0nh CNTT\/An to\u00e0n th\u00f4ng tin. Ch\u1ea5p nh\u1eadn \u1ee9ng vi\u00ean kh\u00e1c chuy\u00ean ng\u00e0nh n\u1ebfu ch\u1ee9ng minh \u0111\u01b0\u1ee3c n\u0103ng l\u1ef1c th\u1ef1c chi\u1ebfn t\u01b0\u01a1ng \u0111\u01b0\u01a1ng (ch\u1ee9ng ch\u1ec9 th\u1ef1c h\u00e0nh, CVE \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1, th\u00e0nh t\u00edch Bug Bounty\/CTF).<\/li>\n<li>Tr\u00ean 4 n\u0103m kinh nghi\u1ec7m trong l\u0129nh v\u1ef1c CNTT\/An to\u00e0n th\u00f4ng tin.<\/li>\n<li>Tr\u00ean 3 n\u0103m kinh nghi\u1ec7m tr\u1ef1c ti\u1ebfp \u1edf v\u1ecb tr\u00ed ki\u1ec3m th\u1eed x\u00e2m nh\u1eadp \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng (kh\u00f4ng t\u00ednh th\u1eddi gian ki\u1ec3m th\u1eed \u1ee9ng d\u1ee5ng Web thu\u1ea7n t\u00fay, v\u1eadn h\u00e0nh h\u1ec7 th\u1ed1ng ho\u1eb7c gi\u00e1m s\u00e1t SOC).<\/li>\n<li>L\u1eadp tr\u00ecnh: th\u00e0nh th\u1ea1o Python v\u00e0 JavaScript (script Frida); \u0111\u1ecdc hi\u1ec3u Java\/Kotlin, Swift\/Objective-C v\u00e0 Dart ph\u1ee5c v\u1ee5 ki\u1ec3m th\u1eed h\u1ed9p tr\u1eafng<\/li>\n<li>Ti\u00eau chu\u1ea9n v\u00e0 ph\u00e1p l\u00fd: OWASP MASVS, ISO\/IEC 27001:2022, PCI DSS 4.0.1 v\u00e0 c\u00e1c chu\u1ea9n thanh to\u00e1n tr\u00ean thi\u1ebft b\u1ecb di \u0111\u1ed9ng (MPoC\/SPoC), NIST CSF 2.0, Lu\u1eadt An ninh m\u1ea1ng, Lu\u1eadt B\u1ea3o v\u1ec7 d\u1eef li\u1ec7u c\u00e1 nh\u00e2n s\u1ed1 91\/2025\/QH15, quy \u0111\u1ecbnh c\u1ee7a Ng\u00e2n h\u00e0ng Nh\u00e0 n\u01b0\u1edbc v\u1ec1 an to\u00e0n giao d\u1ecbch \u0111i\u1ec7n t\u1eed v\u00e0 x\u00e1c th\u1ef1c sinh tr\u1eafc h\u1ecdc.<\/li>\n<li>Ti\u1ebfng Anh chuy\u00ean ng\u00e0nh: \u0111\u1ecdc t\u00e0i li\u1ec7u k\u1ef9 thu\u1eadt v\u00e0 vi\u1ebft b\u00e1o c\u00e1o.<\/li>\n<li>AI: kh\u00f3a \u0111\u00e0o t\u1ea1o ho\u1eb7c ch\u1ee9ng ch\u1ec9 v\u1ec1 AI Security \u2013 AI Red Teaming (v\u00ed d\u1ee5 SANS SEC535).<\/li>\n<\/ul>\n<p>(Ch\u1ea5p nh\u1eadn minh ch\u1ee9ng n\u0103ng l\u1ef1c thay th\u1ebf cho ch\u1ee9ng ch\u1ec9: CVE \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 tr\u00ean \u1ee9ng d\u1ee5ng\/SDK di \u0111\u1ed9ng; x\u1ebfp h\u1ea1ng tr\u00ean HackerOne\/Bugcrowd\/Intigriti \u1edf h\u1ea1ng m\u1ee5c mobile; c\u00f4ng c\u1ee5 ho\u1eb7c script Frida m\u00e3 ngu\u1ed3n m\u1edf t\u1ef1 ph\u00e1t tri\u1ec3n; gi\u1ea3i th\u01b0\u1edfng CTF h\u1ea1ng m\u1ee5c reverse engineering\/mobile.)<\/p>\n<p><strong>\u01afu ti\u00ean:<\/strong><\/p>\n<ul>\n<li>\u01afu ti\u00ean m\u1ea1nh (chuy\u00ean s\u00e2u di \u0111\u1ed9ng): GMOB (SANS SEC575), eMAPT, CMPen-Android\/CMPen-iOS (Mobile Hacking Lab), ch\u1ee9ng ch\u1ec9 ki\u1ec3m th\u1eed \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng c\u1ee7a 8kSec\/Corellium.<\/li>\n<li>N\u1ec1n t\u1ea3ng ki\u1ec3m th\u1eed x\u00e2m nh\u1eadp: OSCP\/OSCP+, OSWE, Burp Suite Certified Practitioner (BSCP), GWAPT (SANS SEC542) cho ph\u1ea7n API backend.<\/li>\n<li>B\u1ed5 sung: SANS SEC661 (khai th\u00e1c thi\u1ebft b\u1ecb nh\u00fang\/ARM), SEC522 (Application Security), ch\u1ee9ng ch\u1ec9 b\u1ea3o m\u1eadt Cloud (AWS\/Azure\/GCP) cho h\u1ea1 t\u1ea7ng backend.<\/li>\n<li>Kinh nghi\u1ec7m ki\u1ec3m th\u1eed \u1ee9ng d\u1ee5ng c\u00f3 giao d\u1ecbch t\u00e0i ch\u00ednh, v\u00ed \u0111i\u1ec7n t\u1eed, eKYC ho\u1eb7c x\u1eed l\u00fd d\u1eef li\u1ec7u c\u00e1 nh\u00e2n quy m\u00f4 l\u1edbn l\u00e0 l\u1ee3i th\u1ebf n\u1ed5i b\u1eadt.<\/li>\n<li>Kinh nghi\u1ec7m d\u1ecbch ng\u01b0\u1ee3c \u1ee9ng d\u1ee5ng \u0111a n\u1ec1n t\u1ea3ng (Flutter, React Native) v\u00e0 v\u01b0\u1ee3t c\u00e1c c\u01a1 ch\u1ebf b\u1ea3o v\u1ec7 th\u01b0\u01a1ng m\u1ea1i (RASP, obfuscation) l\u00e0 l\u1ee3i th\u1ebf n\u1ed5i b\u1eadt.<\/li>\n<li>Kinh nghi\u1ec7m ph\u00e1t tri\u1ec3n \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng (Android\/iOS) tr\u01b0\u1edbc khi chuy\u1ec3n sang b\u1ea3o m\u1eadt l\u00e0 m\u1ed9t l\u1ee3i th\u1ebf \u0111\u00e1ng k\u1ec3.<\/li>\n<li>\u01afu ti\u00ean \u1ee9ng vi\u00ean t\u1eebng l\u00e0m t\u1ea1i c\u00f4ng ty d\u1ecbch v\u1ee5 ki\u1ec3m th\u1eed\/t\u01b0 v\u1ea5n an ninh m\u1ea1ng ho\u1eb7c tham gia th\u01b0\u1eddng xuy\u00ean ch\u01b0\u01a1ng tr\u00ecnh Bug Bounty.<\/li>\n<li>Hi\u1ec3u bi\u1ebft m\u00f4i tr\u01b0\u1eddng tu\u00e2n th\u1ee7 cao (t\u00e0i ch\u00ednh \u2013 ng\u00e2n h\u00e0ng, h\u00e0ng kh\u00f4ng, b\u1ea5t \u0111\u1ed9ng s\u1ea3n, d\u1ecbch v\u1ee5 s\u1ed1) l\u00e0 m\u1ed9t l\u1ee3i th\u1ebf.<\/li>\n<li>\u01afu ti\u00ean \u1ee9ng vi\u00ean \u0111\u00e3 \u0111\u1ea3m nh\u1eadn vai tr\u00f2 d\u1eabn d\u1eaft k\u1ef9 thu\u1eadt (technical lead) cho m\u1ed9t d\u1ef1 \u00e1n ki\u1ec3m th\u1eed ho\u1eb7c h\u01b0\u1edbng d\u1eabn chuy\u00ean vi\u00ean c\u1ea5p th\u1ea5p h\u01a1n.<\/li>\n<\/ul>\n<p><strong>K\u1ef9 n\u0103ng:<\/strong><\/p>\n<ul>\n<li>T\u01b0 duy t\u1ea5n c\u00f4ng c\u00f3 h\u1ec7 th\u1ed1ng: ki\u00ean tr\u00ec d\u1ecbch ng\u01b0\u1ee3c v\u00e0 khai th\u00e1c chu\u1ed7i l\u1ed7 h\u1ed5ng thay v\u00ec d\u1eebng \u1edf k\u1ebft qu\u1ea3 c\u1ee7a c\u00f4ng c\u1ee5 qu\u00e9t t\u1ef1 \u0111\u1ed9ng.<\/li>\n<li>Di\u1ec5n gi\u1ea3i l\u1ed7 h\u1ed5ng k\u1ef9 thu\u1eadt th\u00e0nh t\u00e1c \u0111\u1ed9ng kinh doanh \u0111\u1ec3 thuy\u1ebft ph\u1ee5c \u0111\u1ed9i ph\u00e1t tri\u1ec3n \u01b0u ti\u00ean kh\u1eafc ph\u1ee5c.<\/li>\n<li>Vi\u1ebft b\u00e1o c\u00e1o r\u00f5 r\u00e0ng, t\u00e1i hi\u1ec7n \u0111\u01b0\u1ee3c v\u00e0 tr\u00ecnh b\u00e0y k\u1ebft qu\u1ea3 song ng\u1eef Vi\u1ec7t \u2013 Anh.<\/li>\n<li>K\u1ef9 n\u0103ng ph\u00e2n t\u00edch, gi\u1ea3i quy\u1ebft v\u1ea5n \u0111\u1ec1 v\u00e0 t\u1ef1 nghi\u00ean c\u1ee9u c\u00f4ng ngh\u1ec7 m\u1edbi theo t\u1ed1c \u0111\u1ed9 thay \u0111\u1ed5i c\u1ee7a h\u1ec7 \u0111i\u1ec1u h\u00e0nh di \u0111\u1ed9ng.<\/li>\n<li>Qu\u1ea3n l\u00fd th\u1eddi gian, x\u1eed l\u00fd song song nhi\u1ec1u d\u1ef1 \u00e1n ki\u1ec3m th\u1eed theo ti\u1ebfn \u0111\u1ed9 ph\u00e1t h\u00e0nh \u1ee9ng d\u1ee5ng.<\/li>\n<li>Ph\u1ed1i h\u1ee3p \u0111a b\u1ed9 ph\u1eadn (ph\u00e1t tri\u1ec3n di \u0111\u1ed9ng, backend, v\u1eadn h\u00e0nh, SOC) v\u00e0 h\u01b0\u1edbng d\u1eabn \u0111\u1ed3ng nghi\u1ec7p.<\/li>\n<\/ul>\n<p><strong>C\u00e1c y\u00eau c\u1ea7u kh\u00e1c:<\/strong><\/p>\n<ul>\n<li>\u0110\u1ea1o \u0111\u1ee9c ngh\u1ec1 nghi\u1ec7p v\u00e0 tu\u00e2n th\u1ee7 nghi\u00eam ng\u1eb7t ph\u1ea1m vi ki\u1ec3m th\u1eed (Rules of Engagement), NDA v\u00e0 quy \u0111\u1ecbnh b\u1ea3o v\u1ec7 d\u1eef li\u1ec7u.<\/li>\n<li>Tuy\u1ec7t \u0111\u1ed1i kh\u00f4ng s\u1eed d\u1ee5ng d\u1eef li\u1ec7u, t\u00e0i kho\u1ea3n ho\u1eb7c thi\u1ebft b\u1ecb c\u1ee7a kh\u00e1ch h\u00e0ng th\u1eadt ngo\u00e0i ph\u1ea1m vi \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t.<\/li>\n<li>Kh\u1ea3 n\u0103ng l\u00e0m vi\u1ec7c \u0111\u1ed9c l\u1eadp, ch\u1ee7 \u0111\u1ed9ng nghi\u00ean c\u1ee9u v\u00e0 h\u1ecdc t\u1eadp li\u00ean t\u1ee5c.<\/li>\n<li>S\u1eb5n s\u00e0ng th\u1ef1c hi\u1ec7n ki\u1ec3m th\u1eed ngo\u00e0i gi\u1edd h\u00e0nh ch\u00ednh theo c\u1eeda s\u1ed5 th\u1eddi gian \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t, b\u00e1m s\u00e1t l\u1ecbch ph\u00e1t h\u00e0nh \u1ee9ng d\u1ee5ng.<\/li>\n<li>Tinh th\u1ea7n \u0111\u1ed3ng \u0111\u1ed9i, cam k\u1ebft cao v\u00e0 trung th\u1ef1c trong b\u00e1o c\u00e1o k\u1ebft qu\u1ea3.<\/li>\n<li>L\u00fd l\u1ecbch t\u01b0 ph\u00e1p minh b\u1ea1ch (y\u00eau c\u1ea7u b\u1eaft bu\u1ed9c v\u1edbi v\u1ecb tr\u00ed ti\u1ebfp c\u1eadn h\u1ec7 th\u1ed1ng tr\u1ecdng y\u1ebfu).<\/li>\n<\/ul>\n<p class=\"isSelectedEnd\"><span style=\"font-size: 18pt; color: #0000ff;\"><strong>Quy\u1ec1n l\u1ee3i:<\/strong><\/span><\/p>\n<ul data-spread=\"false\">\n<li>G\u00f3i thu nh\u1eadp c\u1ea1nh tranh (bao g\u1ed3m l\u01b0\u01a1ng c\u01a1 b\u1ea3n v\u00e0 th\u01b0\u1edfng theo hi\u1ec7u su\u1ea5t).<\/li>\n<li>L\u01b0\u01a1ng th\u1eed vi\u1ec7c b\u1eb1ng 100% l\u01b0\u01a1ng ch\u00ednh th\u1ee9c.<\/li>\n<li>B\u1ea3o hi\u1ec3m s\u1ee9c kh\u1ecfe v\u00e0 b\u1ea3o hi\u1ec3m tai n\u1ea1n to\u00e0n di\u1ec7n.<\/li>\n<li>15 ng\u00e0y ngh\u1ec9 ph\u00e9p n\u0103m v\u00e0 3 ng\u00e0y l\u00e0m vi\u1ec7c t\u1eeb xa m\u1ed7i th\u00e1ng.<\/li>\n<li>\u0110\u01b0\u1ee3c cung c\u1ea5p \u0111\u1ea7y \u0111\u1ee7 trang thi\u1ebft b\u1ecb l\u00e0m vi\u1ec7c (MacBook\/Laptop, chu\u1ed9t, m\u00e0n h\u00ecnh, v.v.).<\/li>\n<li>M\u00f4i tr\u01b0\u1eddng l\u00e0m vi\u1ec7c hi\u1ec7n \u0111\u1ea1i, s\u00e1ng t\u1ea1o v\u00e0 n\u0103ng \u0111\u1ed9ng.<\/li>\n<\/ul>\n<p><span style=\"color: #0000ff;\">N\u01a1i l\u00e0m vi\u1ec7c: <strong>T\u00f2a Galaxy Innovation Hub, \u0110\u01b0\u1eddng D1 &#8211; Khu C\u00f4ng Ngh\u1ec7 Cao, Ph\u01b0\u1eddng T\u0103ng Nh\u01a1n Ph\u00fa, TP.HCM<\/strong><\/span><\/p>\n<p><span style=\"color: #0000ff;\"><span style=\"font-weight: 400;\">CV \u1ee9ng tuy\u1ec3n g\u1eedi qua mail: <\/span><b>talent@galaxyholdings.co\u00a0<\/b><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>T\u1ed5ng quan v\u1ecb tr\u00ed: Tr\u1ef1c ti\u1ebfp th\u1ef1c hi\u1ec7n ki\u1ec3m th\u1eed x\u00e2m nh\u1eadp chuy\u00ean s\u00e2u \u1ee9ng d\u1ee5ng di \u0111\u1ed9ng Android v\u00e0 iOS (bao g\u1ed3m \u1ee9ng d\u1ee5ng native, Flutter, React Native) c\u00f9ng to\u00e0n b\u1ed9 API backend ph\u1ee5c v\u1ee5 \u1ee9ng d\u1ee5ng. Th\u1ef1c hi\u1ec7n d\u1ecbch ng\u01b0\u1ee3c (reverse engineering) v\u00e0 ph\u00e2n t\u00edch \u0111\u1ed9ng: v\u01b0\u1ee3t c\u01a1 ch\u1ebf ph\u00e1t hi\u1ec7n root\/jailbreak, SSL [&hellip;]<\/p>\n","protected":false},"template":"","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"default","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}}},"class_list":["post-15592","job","type-job","status-publish","hentry","company-galaxy-holdings","field-tech","job_type-full-time","location-hcm"],"acf":[],"_links":{"self":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/job\/15592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/job"}],"about":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/types\/job"}],"wp:attachment":[{"href":"https:\/\/galaxyholdings.co\/en\/wp-json\/wp\/v2\/media?parent=15592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}