Tasks

• Administration of BEP (Business Email Protection) systems with a dynamic attachment analysis module (F6, Kaspersky KATA/Sandbox, PT Sandbox)
• Deep understanding of protocols: SMTP, DKIM, SPF, DMARC, IMAP/POP3, understanding the architecture of MTA (Mail Transfer Agent), ICAP (Internet Content Adaptation Protocol): integration of sandbox with mail gateways and MTA
• Extraction of IOCs from reports: network indicators (IP, domains), persistence mechanisms
• Understanding of sandbox evasion techniques and methods of their neutralization
• Manual inspection of suspicious files in the sandbox if necessary
• Writing YARA rules for identifying malware by signatures

Requirements

• Deep understanding of protocols: SMTP, MIME, S/MIME, DKIM, SPF, DMARC, IMAP/POP3
• Understanding of sandbox evasion techniques and methods of their neutralization
• Experience writing YARA rules for identifying malware by signatures
• Experience optimizing rules to reduce false positives in mail flow
• Experience with tools: Wireshark, tcpdump, Python (for automating log/PCAP analysis)
• Experience with Threat Intelligence (MISP, APT analysis)

Conditions and Benefits

• Hybrid schedule/remote work
• Working hours: 5/2, from 9:00 to 18:15 (on Friday – until 17:00)
• Opportunity for company-sponsored training and certification: external professional trainings and seminars, industry conferences, management skills development program, in-person master classes, online education platforms, and more
• Developed system of compensation and benefits
• Extensive DML package (including international travel and dental care)
• Life and health insurance
• Discounts in X5 retail chain stores ("Pyaterochka", "Perekrestok")
• Prime-zone privilege program (discounts on goods and services and special offers from partner companies)
• Financial assistance for employees in difficult life situations
• Employment according to the Labor Code of the Russian Federation with an official salary