Hi! We are Marfatech, an international IT-accredited company.
We’ve grown in the market from a traffic acquisition startup to a company with international projects. We are involved in development and BI analytics systems. We like to create and implement new technologies as quickly as possible, with minimal bureaucracy, to make the IT world better!
We are looking for an AppSec Engineer for the product security department, who will work with product teams and help make products and services secure based on the secure-by-design principle.
The role involves participating in the development of new features, analyzing service architecture, implementing DevSecOps practices, and fostering a security culture in development.
An AppSec Engineer is not only about finding vulnerabilities but also about collaborating with teams to improve the quality of products and development processes.
What you will be doing:
- Supporting product features throughout their entire production lifecycle: from business idea to release to production
- Conducting security assessments of products and services developed within the company
- Triaging results from security scanners
- Working with security technical debt for product and infrastructure teams
- Participating in information security incident response
- Providing consultations and training to product teams (secure coding and other AppSec best practices)
- Improving our internal processes
What you will NOT be doing:
- Formal compliance & security theater without real impact on the product
- Writing reports that nobody reads
- Fighting with development instead of collaborating on security
- Implementing security tools for the sake of implementation that nobody uses
- Overcoming bureaucratic barriers to implement an initiative
What is important for the role:
- Understanding of web application vulnerabilities, methods of exploitation, and remediation
- Experience with security tools (SAST/SCA/DAST/Container Security/IaC security, etc.)
- Experience in analyzing application architecture and assessing security risks
- Experience integrating security tools into CI/CD
- Understanding of SSDLC / DevSecOps processes
Will be a plus:
- Bug bounty experience
- Experience implementing AI Security / MLSecOps
- Experience implementing AppSec processes in product companies
- Experience working with cloud infrastructures and containers
How we work:
Open communication, cross-team collaboration, and continuous expertise development are valued in the team. Security is viewed as a part of product quality, so the Product Security department works together with development and business, helping teams manage risks and make technical decisions.
Why this vacancy might be interesting:
This position might be for you if you are interested in answering questions like:
- What real risks can I highlight to the team when developing this feature?
- Which of the dozens/hundreds of security scanner results actually pose a risk to the product?
- How can I reduce product security technical debt without endless tickets and manual triage?
- What compromise can be found to avoid blocking a feature while not significantly impacting security?
- What else can I do to influence the security of the products in my area of responsibility?
We offer:
- Official employment in accordance with the Labor Code of the Russian Federation;
- Competitive salary level;
- Remote work format;
- Complex, interesting tasks;
- Complete absence of bureaucracy;
- Opportunities for career growth and professional development;
- Open and liberal atmosphere in the team — here you can set trends yourself, not follow them;
- Voluntary medical insurance (DMS);
- Partial compensation for sports activities;
- 50% compensation for English language studies;
- Work schedule: five days a week (flexible start of the day);
- 5 sick days per year in addition.
