Kontur is an ecosystem for businesses. Our services help every third company in Russia to make work processes simpler and more efficient: manage accounting, submit reports to government agencies, exchange documents without paper, communicate remotely, and much more. With us, the lives of 3.1 million entrepreneurs and their employees become easier.
About the team
We are the AI security team within Kontur's Cyber Defense Center. We are looking for a cybersecurity specialist who will help implement and support AI-based solutions – from product services and RAG systems to internal AI development tools.
At Kontur, the use of AI assistants and agents is actively developing. Our task is to ensure that these tools are secure, and that developers receive protected results consistent with information security policies, without needing to delve into all the intricacies of information security.
Responsibilities
- Conduct security assessments (primarily Whitebox) of LLM applications, AI agents, RAG, vector databases, Low-Code/No-Code systems (Dify, n8n), and integrations with external APIs / cloud models.
- Identify AI-specific attack vectors: prompt injection, indirect prompt injection, jailbreak, data poisoning, excessive agency, unsafe tool calls, and over-privileged agents.
- Configure and validate protective mechanisms: PII / confidential data filters, context limitations, rate limiting, tool call control, and manual confirmations for critical operations.
- Strengthen internal AI/ML tooling in collaboration with platform teams. Build a system of rules, skills, and hooks to embed information security policies directly into the development environment: skills, rules, hooks, MCP servers.
- Verify the security of local LLM and agent execution in Kubernetes and Linux sandboxes: session isolation, memory, containers, RBAC, NetworkPolicy, Secrets Management.
- Formulate requirements for auditing and tracing AI systems: trace ID, prompt/response logging, recording model calls and agent actions.
- Consult with teams, assist in implementing secure code, and establish clear processes.
What we expect
- At least two years of experience in Information Security in one or more areas: AppSec, DevSecOps, Cloud/K8s Security, Product Security, or ML Security.
- Proficiency in at least one programming language: Python, Go, C#, TS, Rust. Ability to read others' code, find vulnerabilities, and write PoCs.
- Knowledge of the AI/LLM stack: understanding of language models, RAG, vector databases (Milvus, Qdrant, pgvector, etc.), AI agents, agent memory, tool calling, as well as the MCP interaction standard.
- Knowledge of AI threats: understanding of OWASP for LLM risks, MITRE ATLAS (prompt injection, system prompt disclosure, data leaks, unintended agent code execution).
- Basic knowledge of Linux and a fundamental understanding of Kubernetes security: RBAC, ServiceAccount, NetworkPolicy, Secrets, container isolation.
- Knowledge of classic web vulnerabilities, authentication and authorization mechanisms OAuth2, OIDC, JWT, RBAC, and secure development practices – Secure SDLC, Threat Modeling.
- Ability to clearly explain risks and find compromises with development.
What we offer
- Hybrid work format in Yekaterinburg. Office at Maloprudnaya St., 5. We provide everything you need: equipment, a workspace, a library with professional literature, a relaxation area, and a kitchen area with fruits and snacks.
- Income level that depends on your technical knowledge and skills. We regularly review salaries considering professional growth. Financial bonuses are also available.
- Strong engineering community. We regularly hold internal technical conferences, and exchange experience between teams. You will always find someone to consult with.
- Opportunity to switch products, teams, or subject areas within the company. We support development in any direction.
- Communication on a "you" basis and a maximum of horizontal connections within the team to facilitate faster agreements and problem-solving.
- Opportunities to share expertise. We help with speaking at conferences, participating in podcasts or videos, and writing articles.
- Support for professional development. We organize internal and external training.
