Application Security Analyst (SSDLC)

SBERBANK PENSION FUND is actively developing its IT ecosystem. We are looking for a Secure Software Development Lifecycle (SSDLC) Analyst who can build dialogue between business and IT, analyze infrastructure risks and changes, and provide expert opinions on contracts and architectural solutions.

Main Task: To ensure the protection of the company's developed and used applications: architecture, software requirements and integrations, control over the implementation of requirements.

• Ensure interaction between product teams and the contractor implementing the SSDLC process
• Participate with the product owner in meetings with business customers, discussing new features
• Conduct security audits of developed services (architecture, standards)
• Formulate and formalize security requirements for products
• Participate in the examination of business processes, identification of problem areas, and proposals for improving information security
• Monitor the accumulation of technological debt by the product team
• Consult developers and supervise the elimination of identified vulnerabilities
• Control infrastructure changes
• Control the IT asset management process

• Ability to structure information and successfully communicate requirements to both business customers and IT experts
• Familiarity with threat analysis methods (attacks, vulnerabilities)
• Understanding of the cyber threat landscape for application software: specifics of internal infrastructure (general and industry-specific systems) and the external environment (attackers, tools and techniques used, as well as characteristic network attacks)
• Skills in analyzing and describing business processes (AS IS, TO BE)
• Familiarity with threat models: KillChain, MITRE ATT&CK (main TTPs), Pyramid of Pain (IOC, UseCases), and vulnerability databases
• Knowledge of REST API, JSON principles
• Knowledge of SQL at the level of simple queries (ability to write queries)

• Work in an accredited IT company (relevant for all current IT mortgage holders);
• Hybrid work schedule (4 days in the office, 1 remotely) and corporate equipment;
• Health care: we offer voluntary medical insurance and special conditions for family insurance, dental care, and pregnancy management;
• Adaptation program: from the first day of work, you will learn about the company, colleagues, and what is expected of you in the next three months in simple terms;
• IT deferment from military service;
• Discounts on SBER system products and services