We invite an Information Security Specialist to join our team for the control and support of web filtering (KWTS), monitoring and response (SIEM/SOC, honeypot), as well as web application and API protection (WAF). The role involves a wide range of tasks – from setting policies and handling incidents to change management, evidence collection, and report preparation.
Project: Banking
Your responsibilities will include:
- Control and support of KWTS: web filtering policies, antivirus scanning, anti-phishing, SSL/TLS inspection, URL categories, file type control.
- Identification and elimination of bypass routes: direct internet access, unaccounted proxies, alternative DNS, unauthorized VPNs, mobile hotspots.
- Control of user and server web traffic coverage through KWTS or another approved gateway.
- Handling KWTS events: blocks, threats, phishing, bypass attempts, SSL/TLS inspection errors, administrative actions.
- Honeypot setup and support: deployment, lures, simulated services, log collection, alerts, event correlation.
- Development and support of response playbooks for honeypot triggers: verification, localization, evidence collection, analysis, escalation, IOC blocking.
- Transferring IOCs to SIEM/SOC, EDR, IDS/IPS, WAF, email and web gateways for blocking and retrospective search.
- WAF control and support: rules, exceptions, signatures, updates, backups, rollback of changes.
- Web application and API protection: SQLi, XSS, RCE, SSRF, LFI/RFI, path traversal, command injection, brute-force, scanning, bots, DDoS.
- Setting up a positive protection model for critical APIs: allowed URLs, methods, parameters, request formats, file types.
- WAF change management: requests, approvals, risk assessment, testing, rollback, change log.
- Monitoring the flow of KWTS, honeypot, and WAF logs to SOC: requests, triggers, blocks, policy changes, administrative actions.
- Incident investigation: evidence collection (logs, dumps, hashes, timestamps), analysis, escalation, corrective actions.
- Access control to KWTS, honeypot, and WAF consoles: role-based access, MFA, PAM, least privilege.
- Regular review of exceptions and allow rules; cancellation of expired and irrelevant ones.
- Preparation of regular reporting on KWTS, honeypot, and WAF.
- Initiating unscheduled checks during mass attacks, critical failures, infrastructure changes, or regulatory requirements.
What we expect from you:
- At least 3 years of experience in information security (preferably in a bank or financial institution).
- Practical experience in operating or controlling KWTS, proxy servers, web filtering systems.
- Understanding of SSL/TLS inspection, URL categories, reputation analysis, anti-phishing.
- Experience with SIEM/SOC: event correlation, alerts, playbooks, incident response.
- Experience in deploying or supporting honeypots (desirable).
- Practical experience with WAF: rules, exceptions, protection against SQLi, XSS, RCE, SSRF, bots, DDoS.
- Understanding of API protection principles and the positive protection model.
- Knowledge of change management principles, detection mode testing, rollback.
- Understanding of AD/LDAP, SIEM, SOC, Service Desk, Jira operating principles.
- Knowledge of Federal Law 152, GOST R 57580.1, requirements of the Bank of Russia regarding information security and personal data protection.
- Understanding of banking and commercial secrets, rules for working with personal data.
- Experience in handling and investigating information security incidents.
- Experience in maintaining registers, logs, and reports.
- Knowledge of role-based access, least privilege, MFA, PAM principles.
- Experience with honeypots.
- Experience integrating WAF with SIEM/SOC.
- Experience conducting web attack investigations.
- Experience with cloud and on-premises WAF.
- Information security certifications (KWTS, WAF, SIEM/SOC, 152-FZ, GOST R 57580.1).
We offer:
- Employment in a stable and dynamically developing IT company EGAR;
- Work format: office, Moscow, Bolshaya Yakimanka St., 23;
- Work schedule: 9:00 to 18:00;
- Competitive salary, which we are ready to discuss during the interview;
- A full-fledged project team with a clear division of roles;
- Prompt resolution of organizational issues;
- Opportunities for professional growth (vertical or horizontal);
- Learning opportunities (courses, certification);
- Bonuses through the referral program for successful recommendations;
- Maintaining a work-life balance.
