About the company and team
We won't repeat what's written about us on the "About Us" page. There you'll find answers to the questions "Who are we?", "Why are we looking for people now?", and "What are our strategic plans?", there's not much text, the essence is conveyed, and the numbers speak for themselves!
What kind of person are we looking for?
Independent, persuasive, ambitious, with leadership qualities (or the ability to manage without managing:), striving to build a secure infrastructure.
What we offer:
- Ensuring and controlling the security of development and implementing measures to improve it
- Working with a team of people who can make decisions, are ambitious, and passionate about their work and project
- Working with a modern stack of security and CI/CD tools
- Professional growth and development (we have trainings, conferences, a strong team ready to share knowledge and in which you can grow quickly)
In practice, this means we will solve the following tasks:
- Integrating and supporting SSDLC / DevSecOps processes in CI/CD
- Configuring and developing SAST, DAST, SCA, Secret Detection tools, and reducing false positives
- Conducting vulnerability triage: assessing risks, prioritizing tasks, recommending remediation methods, and verifying fixes
- Participating in code and architecture reviews from a security perspective, conducting threat modeling
- Consulting developers on secure development issues
- Auditing secure development processes and practices
What is important to us in you:
- At least 1 year of experience in AppSec / security development
- Understanding of OWASP Top 10, common vulnerability classes, methods of exploitation, and defense
- Practical experience with SAST / DAST / SCA tools, such as Semgrep, Burp Suite, ZAP, Trivy, Dependency-Check
- Automation skills in Python or Bash
- Confident work with Git / GitLab
- Ability to clearly document work results and find common ground with developers
- Ability to read and write code in at least one of the following languages: Python, Go, PHP, C#
Not required, but a plus:
- Commercial development experience
- Working with Docker / Kubernetes in a security context
- Experience with SonarQube, Jenkins, Ansible, Nexus
- Knowledge of Cloud Security and IaC scanning
- Experience with Terraform, Checkov, tfsec, OPA/Kyverno
What we have and are willing to share:
- Legal, timely, and competitive salary
- Voluntary medical insurance (including dental)
- Comfortable workspace and modern hardware
- Flexible schedule. Start of work from 8 to 11
- You don't have to come to the office 5 days a week. We decide within our teams when to come in
- Professional growth (we have internal training, opportunities to attend conferences and meetups, which we sponsor))
- P.S.: And if you don't want to come to the office at all, we also have a remote work option!
