The Critical Information Infrastructure Security Department is looking for an expert.
Your responsibilities will include:
- automation of current activities, reporting, and audits
- development of internal Python applications for automatic data collection from banking IT systems (BI platforms, ITSM, CMDB), maintenance of automated system categorization, data aggregation, and calculation of security metrics
- conducting internal security audits
- verification of compliance of information system development and operation processes with regulatory requirements (Federal Law-187, Decrees of the President of the Russian Federation)
- threat modeling and risk assessment
- creation of detailed threat models according to FSTEC methodology, vulnerability and information security risk assessment
- ensuring compliance with legislation (Federal Law-187)
- full cycle of critical information infrastructure (CII) object management: categorization, sending information to FSTEC/NKCKI, updating threat models after changes in service architecture, preparing reporting documentation for external inspections
- development of internal regulatory framework
- compilation and updating of organizational and administrative documents according to current legislative changes
- AI support for business processes
- using large language model (LLM) technologies to automate the analysis of legislative changes, create applicability matrices for requirements, and prepare analytical materials
- expert support for development and support teams
- continuous monitoring of regulatory compliance, consultative support for bank teams on system development in accordance with legislation.
What is important to us:
- higher professional education in information security
- professional retraining courses of at least 504 hours in programs approved by FSTEC of Russia
- at least two years of practical experience with CII object protection systems
- confident command of programming languages: Python (experience with pandas, numpy libraries is mandatory)
- knowledge of frameworks and tools: SQLAlchemy, OpenPyXL, Django/Flask
- skills in integrating with external services via RESTful API (SIEM, SOAR, Vulnerability Scanners)
- proficiency in CI/CD tools and version control systems (Git/GitLab)
- practical experience in building dashboards and data visualization (Power BI, Tableau, Grafana)
- deep understanding of Russian legislation in the field of CII (Federal Law-187, FSTEC Orders No. 235, No. 239, Decrees of the President of the Russian Federation No. 166, No. 250, Government Decrees of the Russian Federation No. 127, No. 1912)
- ability to independently monitor legislative changes and promptly adjust internal processes
- experience in successful implementation of solutions based on large language models (GPT, BERT, etc.)
- ability to formulate effective prompts for text generation, documentation proofreading, checklist creation, and analytics
- understanding of ethical aspects and limitations of artificial intelligence application in security matters.
We offer:
- comfortable modern office
- office-based work format
- annual salary review, annual bonus
- corporate gym and rest areas
- over 400 educational programs from SberUniversity for professional and career development
- adaptation program and supervisor support at the start
- extended voluntary medical insurance, preferential insurance for family and corporate pension program
- flexible discount on mortgage loans, equal to 1/3 of the Central Bank's key rate
- Prime subscription with the possibility of sharing with three close individuals
- reward for recommending friends to join the Sber team.
CYBERSECURITY AT SBER
Sberbank PJSC represents the Sber brand.
