Security Operations Intern
No salary listed
Ho Chi Minh City, Vietnam
In Person
CybersecuritySecurity Governance, Risk & Compliance
About the job
Requirements
- Be a final-year student or recent graduate in Information Security, Computer Science, or a related field, or have equivalent practical experience.
- Have security fundamentals covering common attack vectors such as phishing, social engineering, credential theft, and malware delivery; basic OWASP Top 10 awareness; and an understanding of why the human layer is a primary attack surface.
- Have a genuine interest in security awareness and security operations, including understanding effective training versus checkbox compliance and measuring behavior change rather than only completions.
- Be familiar with a compliance or control framework such as SOC 2, ISO 27001, or NIST CSF.
- Have working programming ability in TypeScript or JavaScript, including Node.js, REST APIs, basic SQL, and basic React, sufficient to implement from a detailed specification with senior review and AI-assisted tooling.
- Have strong written communication skills to author training content and audit documentation for non-technical employees and external auditors.
- Have an interest in Web3 security, including wallet threats and on-chain verification, and motivation to learn Solidity basics; prior Solidity experience is not required.
- Understand Git workflows, including branching, pull requests, and code review.
Responsibilities
- Design and author the security awareness training curriculum, including modules and quiz banks covering phishing and social engineering, password and MFA hygiene, data handling and classification, secure remote work, and Web3-specific threats such as wallet security, seed phrase protection, approval scams, and fake dApps.
- Map each training module to the compliance requirements it satisfies, including SOC 2 CC1/CC2 and ISO 27001 A.6.3 awareness controls, so auditors can trace evidence to controls.
- Operate the training program day-to-day by enrolling employees, configuring module deadlines and renewal cycles, monitoring completion rates, and following up with employees in coordination with the People team.
- Produce audit-ready reporting, including completion evidence exports, on-chain verification links for auditors, and periodic security-team metrics such as completion percentages, average scores, and weakest topics.
- Use quiz analytics to identify knowledge gaps and iterate on content, treating awareness as a measurable security control.
- Document program runbooks for onboarding new hires, adding a module, annual renewal campaigns, and audit evidence collection.
- Implement the platform from its existing specification under senior review, including Solidity contracts for completion tracking and soulbound certificate NFTs, an Express/TypeScript/PostgreSQL backend with server-side quiz scoring and signed attestations, and a React frontend with a module player, quiz flow, dashboards, admin analytics, and public certificate verification.
- Test and harden the platform by ensuring contract tests pass, running backend integration tests, and completing mandatory security-audit and business-logic checks before every pull request; achieve zero Critical or High findings before deployment.
- Deploy the platform and support its operation.
Desired Qualifications
- Have security research, hands-on security, or Blue CTF experience.
- Have prior exposure as an administrator or content author to an awareness training or phishing-simulation platform such as KnowBe4 or GoPhish.
- Have experience with SOC/security operations tooling or contributing to audit evidence collection.
- Have exposure to Solidity, Hardhat, ethers.js, or an EVM chain; Ronin experience is a plus.
- Have experience creating instructional content such as slides, videos, or quizzes, or running internal campaigns.
About the company
Sky Mavis builds blockchain-powered gaming platforms and tooling to create virtual worlds. Its flagship game, Axie Infinity, lets players own NFT creatures, trade them, and battle within an in-game economy backed by the blockchain. Ronin is an EVM-compatible blockchain designed for game developers to deploy smart contracts with high performance and lower fees. The goal is to help developers build blockchain games and give players real ownership in digital worlds by integrating blockchain into play.
Company Size
51-200
Company Stage
Late Stage VC
Total Funding
$311.9M
Headquarters
Singapore, Singapore
Founded
2019
Get referred to Sky Mavis
See people who can refer or advise you
Simplify's Take
What believers are saying
- Terrariums V1 launched June 17, 2026, reviving land utility and AXS engagement.
- Atia’s Legacy continues playtests through 2026, signaling active investment in a new MMO.
- Sky Mavis backed Cambria’s $2 million round in August 2026, reinforcing Ronin ecosystem gravity.
What critics are saying
- Axie Classic ends studio support September 10, 2026, exposing weak retention without Sky Mavis.
- Ronin’s 2022 bridge hack still defines trust risk and institutional memory around security.
- If Atia’s Legacy underperforms, Sky Mavis lacks another breakout to replace Axie demand.
What makes Sky Mavis unique
- Ronin remains Sky Mavis’s gaming chain, now moving toward Ethereum L2 by Q2 2026.
- Axie Classic, Origins, Terrariums, and Atia’s Legacy reuse the same Axie IP.
- Sky Mavis now offers publisher support, validator security, and payments infrastructure through Ronin.
Help us improve and share your feedback! Did you find this helpful?
Benefits
- Hybrid Work Options
- Flexible Work Hours