Engineer for the Security Team of Verticals

The Verticals develop classifieds services: Auto.ru, Yandex Travel, Real Estate, and Rentals, which help users book hotels, find cars, or new homes. Your work will directly impact the security of services that have become reliable helpers for users. You will delve into their heterogeneous architecture, participate in shaping processes from the early stages, and help create truly reliable digital solutions to ensure the security of data for millions of users.

About the Team

More about our team

What tasks await you

Ensuring service security You will be responsible for identifying vulnerabilities in source code, APIs, mobile and web applications, participating in architectural security design reviews, independently conducting internal product audits and supporting external ones. You will need to implement and use DevSecOps tools (SAST, DAST, SCA, and others) and automate security tasks.

Consulting teams on information security issues You will consult Yandex teams on security issues, approve critical changes in code and service infrastructure. You will need to effectively interact with the development team to jointly analyze discovered vulnerabilities and their subsequent elimination—for example, explaining how to properly organize the storage of critical data, integrate a new service, or eliminate a vulnerability.

Participation in security department projects Together with colleagues, you will participate in developments and initiatives that improve the security of all of Yandex.

More about security at Yandex — in the Yandex for Security channel

We expect you to

• Have analyzed the security of web applications for at least two years
• Have designed architectural services and analyzed security risks
• Find bugs in service source code written in Java, Kotlin, Python, Scala, and PHP
• Determine the root cause of a vulnerability, create PoC, and propose risk mitigation measures
• Conduct reasoned dialogue with stakeholders using a risk-oriented approach
• Have built a secure application development lifecycle (SDLC: SAST, DAST, IAST, SCA, etc.)
• Know how to automate work using Golang or Python
• Be a confident Linux user, know OS and container hardening

Will be a plus

• Have ensured the security of Docker, Kubernetes, or Linux
• Participate in Bug Bounty
• Have your own CVEs, developments, and achievements in mobile and web application security
• Have participated in or organized CTF competitions