The Ozon Bank team creates and develops services for buyers and sellers. We are building a bank as a modern IT product — with advanced technologies and a microservice architecture. We implement all the most complex and important banking systems ourselves: processing, accounting core, financial monitoring, transfers through the Faster Payments System. Our products include virtual and plastic cards for profitable purchases on Ozon and beyond, installment plans, a bank for legal entities, and seller financing programs.
We are looking for an engineer for the monitoring and response group (SOC) of the information security department: research for detection, platform and telemetry sources, automation, improvement of detection and investigation processes.
The main monitoring stack is Elastic (log management, correlation, and detection), and we are also developing IRP/SOAR and related integrations.
Your responsibilities will include:
- Researching techniques, TTPs, and real telemetry: coverage gaps, rule weaknesses, typical bypasses. Preparing hypotheses, verification criteria, and detection mechanics for new and enhanced detections.
- Identifying missing sources, coordinating with system owners, and creating custom telemetry: agents, parsers, scripts, enrichment.
- Developing the monitoring platform on Elastic: data quality, integrations, ingestion bottlenecks.
- Building and implementing automation for detection and the platform: scripts, services, CI/CD for rules and configurations, integrations with IRP/SOAR and internal APIs.
- Participating in response orchestration.
- Participating in reviews of complex detection changes (coverage, noise, risk of missed events) and developing the knowledge base and playbooks.
We expect:
- 3+ years of experience in InfoSec, Incident Response, or SOC, in both analytical and engineering roles.
- Ability and experience in automating routine tasks and implementing new technologies in SOC to improve coverage and response: scripts, AI, deployment. This also includes programming in Python and other scripting languages, GitOps, developing telemetry and detection mechanics.
- Solid knowledge of attacker techniques, modern technologies, and infrastructures: network protocols, operating systems, clouds, virtualization, and containers.
- Ability to formulate hypotheses and suggestions for improvement, and to evaluate monitoring quality not in a vacuum, but with an understanding of its relevance to the infrastructure you are working with.
Will be an advantage, knowledge of:
- Elastic Stack: ingest, agents, pipelines, EQL, correlation.
- Parsers and data quality: Logstash, grok, observability of log delivery itself.
- IRP/SOAR, REST API, internal services.
- Host telemetry for detection: Sysmon, auditd, osquery, eBPF agents like Tetragon.
