DevSecOps Specialist, Red Soft
Salary: up to 300k (net)
Location: Saint Petersburg (Elektrosila metro station)
We are looking for a Software Security Specialist with practical experience in fuzz testing. The main task is to set up, run, and develop fuzzing processes to find bugs and potential vulnerabilities in software, as well as to automate these processes and integrate them into secure development pipelines.
In addition to fuzzing, you will work with static and dynamic analysis tools, dependency analysis, and other AppSec tools.
Your responsibilities will include
- Setting up and conducting fuzz testing of system and application software using AFL++, libFuzzer, and similar tools.
- Preparing fuzzing environments: building instrumented projects, configuring compilers, sanitizers, and launch parameters.
- Analyzing source code and application architecture to select fuzzing targets, identify entry points, and prepare harness wrappers for the components being tested.
- Setting up code coverage collection and analysis, evaluating fuzzing effectiveness, and optimizing its performance.
- Integrating fuzz testing into CI/CD pipelines, developing scripts and reusable components for automating launches and processing results.
- Performing static and dynamic code analysis using SAST/DAST tools, validating results, and filtering out false positives.
- Analyzing third-party dependencies using SCA tools and searching for secrets in source code.
- Participating in the development of secure software development lifecycle (SSDLC) processes and supporting the technical requirements of GOST R 56939-2024.
Mandatory requirements
- Strong proficiency in Linux, command line, and diagnostic/debugging tools.
- Practical experience in setting up and running fuzzers, such as AFL++ or libFuzzer.
- Understanding of coverage-guided fuzzing principles, input mutation mechanisms, and the impact of code coverage on fuzzing effectiveness.
- Experience in building instrumented projects, working with compilers and sanitizers, such as AddressSanitizer and UndefinedBehaviorSanitizer.
- Programming or automation skills in Python and/or Bash.
- Experience with CI/CD systems (Jenkins, GitLab CI, GitHub Actions, or similar) and test automation.
- Understanding of static code analysis principles and the ability to verify the results of automated tools.
Will be a plus
- Experience in building infrastructure for parallel or distributed fuzzing, managing multiple agents, and collecting results.
- Experience with afl-cov, gcov, llvm-cov, or similar code coverage analysis tools.
- Experience in fuzzing system libraries, network services, parsers, protocols, or database components.
- Experience with SAST tools: Svace, Semgrep, CodeQL, SonarQube, Bandit, and others.
- Experience with DAST tools, Valgrind, and sanitizers.
- Experience using Trivy, Dependency-Track, Gitleaks, TruffleHog, and similar tools.
Hiring process:
- Call with recruiter (10 min)
- Technical online interview (1 hour)
- Short test assignment (max 2 hours)
- In-office meeting/team introduction
Offer
Contacts: recruiter contact
