AppSec Engineer, Right Line

Salary: 300,000 net

We are Right Line, a Russian IT company operating since 2017. We develop solutions for banks and financial companies.

We are developing secure development practices for the company's internal products and are looking for an Application Security Engineer to help embed security into all stages of the SDLC – from design and development to operation.

Responsibilities: • Conduct application and service vulnerability assessments (SAST, SCA, DAST, secret detection, fuzzing), prepare POC exploits and clear reports for teams; • Conduct vulnerability triage: risk and impact assessment, prioritization, task assignment for remediation, monitoring of deadlines and quality of vulnerability elimination; • Participate in design: conduct threat modeling (e.g., STRIDE), security architecture reviews and design solutions, formulate requirements for authentication, authorization, encryption, and logging; • Develop SSDLC and DevSecOps: define and implement security controls at the requirements, design, development, testing, and operation stages, configure security gates in GitLab CI/CD; • Support and develop AppSec tools: integrate scanners into the development pipeline, configure policies, exceptions, and reporting, participate in the selection and piloting of new solutions; • Participate in service security audits and incident investigations: analyze root causes, develop sustainable measures to prevent the recurrence of entire classes of vulnerabilities; • Advise development teams and architects on secure development issues, vulnerability analysis and remediation, and secure coding patterns; • Conduct AppSec training sessions, workshops, and seminars (OWASP Top 10 / API Security, secure authentication and session management, API and integration protection, etc.); • Research new attack vectors and AppSec trends, propose improvements to processes and tools.

Candidate Profile: • Higher technical education (preferably in information security or comparable practical experience in application development/security); • At least 3 years of experience as an Application Security Engineer, participation in real-world projects for protecting production web or API services; • Practical experience in implementing and operating tools: SAST, SCA, DAST, fuzzing, secret scanning. Integration of these tools into CI/CD (preferably GitLab CI/CD); • Experience with Docker, Kubernetes, GitLab (or similar version control and CI/CD systems); • Ability to conduct code reviews with a focus on security, provide developers with clear and practical recommendations; • Proficiency in at least one programming language (Python / Go / Bash); • Deep understanding of the causes and exploitation methods of OWASP Top 10 and OWASP API Security vulnerabilities, as well as practical remediation of these issues; • Communication skills: ability to explain complex technical risks in understandable language, negotiate priorities, constructively defend the security position; • Readiness to take responsibility for results: from the quality of found vulnerabilities to ensuring the team implements a sustainable fix, not a workaround; • Preference will be given to candidates with experience in transactional business or payment systems, with a deep understanding of payment technologies and specifics of working in B2B/B2G segments.