Experience required: 3 to 6 years
Full-time, 5/2, remote work
Moscow
Business Center “Bruce Premier Office”
Bryusov Ln., 2/14, Bldg. 9
Metro: Biblioteka imeni Lenina
We are looking for an AppSec Engineer to join the e-commerce Cybersecurity Department. This is a broad AppSec role: you will not only perform pentesting but also design, analyze service architecture, build threat models, review code, form requirements for secure development, and ensure their implementation. The team is currently growing, and you will be joining not to "finish up" or "support," but to build the AppSec process together with the manager and engineers.
Responsibilities:
- Verify the security of services, applications, architecture, and new features – and oversee the implementation of measures to eliminate identified risks.
- Provide recommendations for building secure architecture, describe the target architecture based on best practices (including OWASP).
- Analyze the code of services developed by the company for vulnerabilities.
- Conduct security audits of necessary environments and applications (web, API, mobile).
- Conduct audits and testing of loyalty programs for security and potential abuse, including business logic analysis.
- Prepare reports on audit results, create Jira tasks with recommendations, track them to closure and re-verification, and control the prevention of security technical debt accumulation.
- Build and maintain up-to-date threat models for assigned services.
- Develop recommendations for improving automatic vulnerability analysis scanners (in conjunction with DevSecOps).
- Analyze vulnerabilities received through the bug bounty program: triage, assessment, recommendations.
- Provide theoretical and practical assistance to junior team specialists, participate in their training and knowledge transfer.
Candidate Profile:
- 5+ years of commercial experience in AppSec / security analysis.
- Deep knowledge of web technologies, understanding of microservice application architecture.
- Understanding of OWASP Top 10 and OWASP Mobile Top 10 vulnerabilities and the ability to exploit them.
- Proficiency with tools: nmap, BurpSuite, ZAP, MSF, SQLmap, nuclei, mobsf, gobuster, and others. Ability to explain how they work in a "live" environment.
- Experience in building threat models (STRIDE / threat modeling) and architecture review.
- Experience in code analysis (security-focused Code Review) for at least one common tech stack.
- 3+ years of penetration testing experience for web applications, mobile applications, and APIs.
- Knowledge of information security principles (WAF and service-level solutions).
- Ability to bypass application-level and information security controls.
Advantageous:
- Experience in e-commerce, fintech, or marketplaces (understanding risks related to payments, authorization, bonus systems, loyalty programs).
- Understanding of infrastructure vulnerabilities.
- Scripting skills (Python, Bash) for test automation.
- Relevant certifications.
- Successful participation in CTFs.
- Higher education in Cybersecurity or IT.
Why it's good to work with us:
- An accredited IT company that creates and develops one of the country's TOP-10 largest online stores*.
- Personalized salary offer and official employment; we value transparency and honesty.
- Hybrid work format.
- Career consultant assistance for choosing an individual development path.
- Comprehensive social package including dental care, office meal compensation, discounts, and partner bonuses – everything to make life and work comfortable.
- Modern work equipment.
- Stylish and cozy offices in the centers of Yekaterinburg and Moscow.
- A like-minded corporate culture and special energy – you'll feel like you belong here.
- English language learning in the GA English Club, compensation for training, and development in our own online university to grow with the company.
- No dress code or appearance restrictions. We respect your individuality.
Join an international and stable business – your future is secure with us!
*According to the Data Insight rating in 2025.
