Hello! We are the "Golden Apple" team, passionate about our work. We don't have room for standards; we are looking for bold and ambitious individuals ready to bring their ideas to life across Russia and beyond. If you are burning with the desire to change the beauty industry, you are our person!
We are looking for an AppSec Engineer in the e-commerce Cybersecurity Department.
This is a broad AppSec role: you will not only work hands-on in pentesting mode but also design — analyze service architecture, build threat models, review code, formulate requirements for secure development, and support their implementation. The team is currently growing, and you will join not to "finish up" or "support," but to build the AppSec process together with the manager and engineers.
What needs to be done:
- Verify the security of services, applications, architecture, and new features – and support the implementation of measures to eliminate identified risks.
- Provide recommendations for building secure architecture, describe the target architecture based on best practices (including OWASP).
- Analyze the code of services developed by the company for vulnerabilities.
- Conduct security audits of necessary environments and applications (web, API, mobile).
- Conduct audits and testing of loyalty programs for security and potential abuses, including business logic analysis.
- Compile reports on audit results, create Jira tickets with recommendations, track them to closure and re-verification, and control the prevention of security technical debt growth.
- Build and maintain up-to-date threat models for assigned services.
- Compile recommendations for improving automatic vulnerability analysis scanners (in collaboration with DevSecOps).
- Analyze vulnerabilities received through the bug bounty program: triage, assessment, recommendations.
- Provide theoretical and practical assistance to junior specialists in the team, participate in their training and knowledge transfer.
What we expect from the candidate:
- Commercial experience in AppSec / security analysis of 5+ years.
- Deep knowledge of web technologies, understanding of microservice application architecture.
- Understanding of vulnerability types from OWASP Top 10 and OWASP Mobile Top 10, and the ability to exploit them.
- Ability to work with tools: nmap, BurpSuite, ZAP, MSF, SQLmap, nuclei, mobsf, gobuster, and others. Ability to explain how they work in a "live" environment.
- Experience in building threat models (STRIDE / threat modeling) and architecture review.
- Experience in code analysis (security-focused Code Review) on at least one of the common stacks.
- Experience in penetration testing of web applications, mobile applications, and APIs for 3+ years.
- Knowledge of information security principles (WAF and service-level solutions).
- Ability to bypass application-level and information security measures.
Will be an advantage:
- Experience in e-commerce, fintech, or marketplaces (understanding risks of payments, authorization, bonus systems, loyalty programs).
- Understanding of infrastructure vulnerabilities.
- Scripting skills (Python, Bash) for test automation.
- Relevant certifications.
- Successful participation in CTFs.
- Higher education in Information Security or IT.
Why it's good with us:
- Accredited IT company that creates and develops one of the TOP-10 largest online stores in the country*.
- Personal salary offer and official employment; we value transparency and honesty.
- Hybrid work format.
- Career consultant support for choosing an individual development path.
- Comprehensive social package with dental care, office meal compensation, discounts and bonuses from partners — everything to make life and work comfortable.
- Modern work equipment.
- Stylish and cozy office in the center of Yekaterinburg and Moscow.
- A corporate culture that resonates with you and a special energy — you'll feel like you belong here.
- English language learning at GA English Club, compensation for training, and development in our own online university so you can grow with the company.
- No restrictions on dress code or appearance. We respect your individuality.
Join an international and stable business — feel secure about your future with us!
*According to Data Insight rating in 2025.
