Senior Information Security Engineer
Senior information security engineer owning the external attack surface of a real estate group: securing public websites, client portals, email domains (SPF/DMARC/DKIM) and sensitive data, partnering with DevOps and developers to ship fixes, and running the external pentest program. Secondary scope: SaaS access governance and SIEM/DLP/EDR business case. Reports to the CIO.
- Compensation
- Not disclosed
- Location
- Thailand
- Work setup
- Remote
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 5+ years
- Category
- Security
- Posted
Skills
Must have
- 5+ years in information security or security engineering with a track record of closing attack-surface issues (DNS/email spoofing, exposed secrets, unpatched perimeter gaps)
- Hands-on experience with email/domain authentication (SPF/DMARC/DKIM), TLS/HSTS, and web security headers
- Experience hardening Google Workspace (or similar) against account takeover: 2FA/phishing-resistant auth, anomalous-login monitoring, locking down admin access to high-value systems
- Experience finding or driving remediation of real-world web application weaknesses: exposed secrets, missing CAPTCHA/rate limiting, CORS and header misconfigurations
- Comfortable working cross-functionally with DevOps and developers to get fixes shipped
- Experience scoping and managing external security audit or pentest vendors
- Working knowledge of Linux and Windows, and core networking concepts
Nice to have
- Experience governing identity/access across a large portfolio of SaaS tools (2FA rollout, admin account audits)
- Solid understanding of what SIEM, DLP, and EDR tooling solve, and experience building a business case for or against adopting one
- Experience with CDN/WAF platforms (Gcore, Cloudflare)
- Awareness of data protection/privacy considerations relevant to handling client leads and personal data
Full description
Senior Information Security Engineer
Villacarte Group — IT Department
About VillaCarte Group
VillaCarte Group is a premium real estate development and hospitality company based in Phuket, Thailand, since 2012. Our portfolio includes residential projects Layan Green Park, LaVista Villas and Layan Verde, the VillaCarte real estate agency, La Green Hotel.
Here you can find more information about our corporate culture and benefits -
About the Role
Priority #1 for this role: close the gaps our recent external audit found, then keep pushing our attack surface tighter from there, so our websites and client portals stay up and untampered, our email domains can't be used to scam people, and our data doesn't walk out the door. No security posture is ever fully "done", what we want is someone who keeps this at the top of their list, not squeezed in between other things.
We're hiring a Senior Information Security Engineer to own the external security of our company websites and client-facing portals, our email domains, and our data. You'll work closely with our DevOps team (who own infrastructure execution) and our in-house developers (who own application code) to get fixes shipped, and you'll run our external pentest/audit program as the outside check that it's actually working.
There's a secondary layer of work too (access governance across our ~40-service SaaS portfolio, evaluating security tooling). You own that as far as your bandwidth allows. If it starts eating into the primary mission, that's your signal to make the case for hiring someone under you, not to let either side slip.
Reports to: CIO
Key Responsibilities
Priority #1: close and keep closing the external attack surface
- Own the security and integrity of our public websites and client-facing portals: hardened access to DNS/CDN/hosting panels so changes can't happen outside a controlled process, removal of wildcard DNS records, closing of exposed admin/API endpoints
- Stop email spoofing and account takeover: SPF and DMARC on every company domain, moved all the way from p=none to p=reject, with DKIM verified for every sending system (Google Workspace, Zoho, SendPulse, and others), plus enforced 2FA/phishing-resistant login and anomalous-login monitoring on Google Workspace, especially for sales staff. This is what actually stops the costliest scenario for a real estate business: someone hijacking a live deal thread to redirect a client's wire transfer
- Prevent data theft: get secrets out of client-side code, add CAPTCHA and rate limiting on public forms, enforce HTTPS/HSTS and secure cookie flags, and lock down access to the systems that actually hold sensitive data (our CRM's client and deal records, HR data, financial systems, and our password vault): admin account audits and 2FA there are core to this mission, not an afterthought