Secure Development Engineer (AppSec)

Sber2V is a business services system under unified management. Together, we solve complex problems for the state, business, and regions using big data analytics, artificial intelligence, automation, and electronic document management.

We in numbers: • 50+ proprietary solutions • 1.2 million small business clients • 40+ industries use our products • 2.5 thousand large business and public sector clients

Our technologies (big data analytics, machine learning, visualization) help businesses grow and regions develop.

We are looking for candidates to strengthen the SberCorus Cybersecurity team for the roles of Secure Development Experts/Engineers (AppSec).

• Big plans: we are growing and developing all our products within the SBER Group's vertical to become leaders in Russian electronic document management;
• Continuous improvements: we use new ideas, methods, and technologies

We are confident that we are bringing the future closer in terms of technology and human possibilities!

• Working with secure development tools SAST, DAST, SCA, ASOC, MAST;
• Conducting security audits of the company's applications and services;
• Assessing risks and developing measures to mitigate them;
• Identifying critical system components and protection priorities;
• Interacting with and supporting development teams on information security and secure development practices;
• Approving releases and participating in PSI (pre-shipment inspection);
• Triaging software vulnerabilities;
• Performing software scanning

• Understanding of modern methods for testing applications for vulnerabilities (SAST/DAST/IAST/SCA/Penetration Testing);
• Experience in identifying and eliminating common vulnerabilities (XSS, SQL Injection, CSRF);
• Practical experience analyzing source code for weaknesses and potential threats;
• Proficiency with static and dynamic security analysis tools (Burp Suite, OWASP ZAP, SonarQube, Veracode, etc.);
• Knowledge of methodologies for conducting security analysis of web applications and APIs;
• Ability to develop recommendations for improving application security;
• Experience in triaging vulnerabilities and interacting with the development team

• Work in an accredited IT company;

• Hybrid work schedule in Moscow or St. Petersburg

• Voluntary medical insurance, telemedicine, annual check-ups – after the probationary period;

• Dentistry and maternity care coverage – after 2 years of employment with the company;

• Accident and illness insurance, as well as special conditions for family member insurance;

• Adaptation program: from the first day of work, you will learn about the company, colleagues, and expectations for the next three months in simple terms;

• Corporate training;

• Free SberPrime subscription and discounts from partners and Sber group services;

• New Year's gifts for children, corporate events, and support in special life situations;

• Discounts at X-Fit, WorldClass fitness clubs

• Most HR processes are automated through electronic document management - everything is prompt and simple;

• Development: we have a corporate training portal – study what you like online

• There is an opportunity to grow within the current team structure or in other departments