BASIS is a developer of software products for cloud services and a dynamic infrastructure platform.
BASIS supplies and integrates virtualization solutions to major government and commercial clients. We are actively involved in replacing imported solutions with our own.
Responsibilities:
- Conducting a full cycle of penetration testing for web applications, virtual and network infrastructure;
- Preparing detailed reports describing attack vectors, exploited vulnerabilities, PoC code, and practical recommendations for remediation;
- Analyzing and adapting ready-made exploits, writing Proof-of-Concept (PoC) to confirm the presence of vulnerabilities;
- Analyzing vulnerabilities at the orchestration level: RBAC, PodSecurityPolicy, network policies, etcd security;
- Automating tasks for setting up environments (Bash/Python for initializing databases, creating users, generating fake data).
Requirements:
- Knowledge of network protocols, storage protocols, infrastructure construction principles, and Kubernetes fundamentals (Pod, Service, Ingress);
- Knowledge of common infrastructure vulnerabilities, attack principles, and defense methods;
- Experience with security tools (Nmap, Burp Suite, Metasploit, nuclei, ZAP, trivy, docker-benchmark, kube-bench);
- Proficient in Linux, ability to write scripts in Python/Bash;
- Experience in independently deploying environments and analyzing them (checking network accessibility, configuration correctness);
- Understanding of how Kubernetes (k8s) works at a level sufficient to deploy a test cluster and identify typical configuration vulnerabilities.
Will be a plus:
- Proficiency with DevOps tools;
- Ability to clearly explain technical issues to developers or management;
- Participation in CTF events;
- Creating issues for products;
- Writing thematic articles.
Conditions:
- Employment according to the Labor Code of the Russian Federation;
- Competitive salary based on interview results;
- Quarterly bonuses;
- Work schedule 5/2, Monday-Friday, flexible start time;
- Social package (Voluntary Medical Insurance, mobile communication reimbursement).
Full-time. Remote work possible.
