Who we are We are the Cybersecurity and Cyber Resilience Center at Gazpromneft Digital Solutions, an information security monitoring center, part of Gazprom Neft's IT function. We are a team that ensures the security of information assets and the continuity of business processes based on the use of information technologies by promptly responding to and proactively addressing existing and potential cyber threats. The main tasks of the center include round-the-clock monitoring of events indicative of incidents, prompt detection and counteraction against internal and external information security intruders, ensuring the operation of information security tools and instrumental control of the company's information resources security, analyzing new cyber threats, and planning measures to reduce the risks of their realization.

What you will do

• Plan and conduct comprehensive penetration tests
• Actively test the company's external network perimeter
• Model attacks on Active Directory – from initial access to full domain control takeover
• Find, analyze, and safely exploit vulnerabilities to prove their criticality
• Find and implement methods for bypassing security systems (AV, EDR, WAF)
• Compile detailed technical reports with evidence of compromise and recommendations for remediation
• Consult teams and developers on remediating found vulnerabilities

We expect you to

• Understand methods and techniques for compromising information systems and services
• Have experience in finding and exploiting vulnerabilities in web applications and network services
• Have experience in finding and exploiting vulnerabilities and configuration weaknesses in Linux OS
• Have experience in finding and exploiting vulnerabilities and configuration weaknesses in Windows OS and Active Directory
• Have experience in finding and exploiting vulnerabilities and configuration weaknesses in DBMS, virtualization, and containerization systems
• Understand methods and techniques for bypassing security systems (AV, EDR, WAF)
• Have programming experience sufficient to understand and write exploits and automate vulnerability discovery tasks

What you get

• Work in an accredited IT company (with all benefits for IT company employees)
• Salary commensurate with your professional level
• High-quality VHI program with dentistry from the first month of work, 24/7 telemedicine services, the option to expand the list of clinics, life and health insurance, rehabilitation programs, preferential insurance terms for relatives
• Compensation for sports memberships: the company reimburses up to 60% of the cost of any sports activities
• Support from an experienced mentor from the first working day
• Unlimited access to the company's knowledge portal, regular training and development programs for hard skills, corporate access to educational platforms and electronic libraries with IT literature (and more)
• Opportunities to participate in meetups of internal professional communities and external conferences; career counseling
• A "smart office" with a coworking space that has everything for productive work and pleasant relaxation
• Socializing beyond work – regardless of which city you work in! From participating in 80+ interest-based corporate communities and challenges to online excursions and networking events
• And also: corporate sports competitions, career guidance programs for employees' children, pension programs, partner discounts

At Gazprom Neft, you can today

• Become part of a team of cybersecurity experts – currently over 120 people, where the company's scale has fostered and continues to foster unique competencies at the intersection of information security and IT – and gain unique experience with enterprise-level innovative solutions, which we have been working with for a long time
• Adapt and develop the processes and tools of the Gazprom Neft information security monitoring center to the continuously changing cyber threat landscape
• Gain unique experience in building and developing cyber defense systems for one of the most complex and extensive infrastructures in the country and the world
• Work with the best market solutions for monitoring and response, and implement these solutions within the company's perimeter (over 100 subsidiaries)
• Create non-standard solutions and actively interact with market leaders in information security (companies: Kaspersky, RVision, Positive Technologies, Solar)
• Be in a team of professionals from whom you can learn and who are inspired by highly complex tasks. A unique opportunity for expert growth in the field of cybersecurity
• Implement and support projects and observe their impact on the group of companies. See the results of your work across the company's entire infrastructure (tens of thousands of users and thousands of systems) with each new project phase and implemented product
• Find your non-trivial task and choose a process you want to improve, or learn something new you haven't worked with before. We have a broad scope for creativity and extensive systemic work
• Get your mentor who will help during the transition period and guide you through the process; interact with business customers, achieve goals together with the team
• Try different teams – the company offers opportunities for internal transfers between departments within the Competence Center and between Competence Centers