With us, you will:
- Formulate information security requirements for new and modified information systems.
- Conduct expertise of developed/existing IT systems for compliance with information security requirements.
- Participate in project activities as an IS expert, advising teams on the implementation of information security requirements.
- Monitor the compliance of developed IT systems with regulatory requirements in terms of IS.
- Prepare organizational and administrative documents (materials) on information security.
- Participate in acceptance testing of information systems on the IS side.
- Participate in risk processing procedures.
What knowledge and skills are important to us:
- Higher education in information security or IT technologies.
- Experience in conducting technical audits of information systems for compliance with IS requirements.
- Experience in assessing risks and formulating IS requirements for systems under development (what is risk, what constitutes risk, causes of risks, types of risks, risk assessment).
- Experience in developing regulatory and methodological organizational and administrative documentation.
- Understanding of IT project management principles.
- Understand the principles of software development using both Agile and Waterfall methodologies.
- Understand the basics of using DevOps in organizing the process of software development and implementation.
- Know the main regulatory documents on Information Security and documents regulating the Bank's operations:
- Federal Law 63-FZ "On Electronic Signatures", 395-1-FZ "On Banks and Banking Activities", 161-FZ "On the National Payment System", 152-FZ "On Personal Data", 98-FZ "On Commercial Secrets".
- GOST R 57580.1-2017, GOST R 57580.2-2018, GOST R 15408-1;
- Orders of FSTEC No. 21, No. 31, No. 239;
- Regulations of the Central Bank 683-P, 719-P, 802-P, 716-P;
- PCI DSS standard, security requirements for MIR payment cards.
- Understand IS tools (what they are, types, installation locations, purpose) - Anti-DDoS, WAF, FW, Antivirus, Sandbox, IPS, IDS, DLP, PAM, MDM, Database Protection;
- SAST, DAST, Configuration Control;
- SIEM, SOC, IM, IRP.
