Security Engineer at FanTech

FanTech Plus is one of the fastest-growing businesses within Yandex. Our teams develop Kinopoisk, Music, Yandex Afisha, Books, Plus Gaming, Skazbuka, and the Plus subscription, which unites the entire Yandex ecosystem. Millions of viewers, listeners, and subscribers use these services. Every day we distribute tens of thousands of terabytes of content, help sell thousands of tickets, and award millions of Plus points.

We are looking for an engineer who will help teams launch secure services and ensure the safety of user data and content from rights holders.

What tasks await you

Security of FanTech services You will identify vulnerabilities in the source code or APIs of web applications, participate in architectural design reviews for information security, and conduct audits. You will also implement and use automation tools for security processes and service security assessments: SAST, DAST, SCA, and others.

Security consulting You will consult other Yandex teams on security matters: explain how to properly store critical data, integrate a new service, or remediate a vulnerability.

Participation in security projects Together with colleagues, you will participate in developments and initiatives that improve the security of the entire Yandex.

More about security at Yandex — in the Yandex for Security channel

We expect that you

• Can navigate large projects
• Understand code and are familiar with popular libraries and frameworks: Java, Kotlin, JS, TS, Go, Python (backend), Swift, Flutter (mobile), PHP, Ruby, and .NET
• Can find technical and logical vulnerabilities

Will be a plus

• Have worked with Semgrep, CodeQL, Burp Suite Enterprise, Nuclei, and other security analysis tools
• Have participated in Bug Bounty programs
• Are the author of a couple of CVEs
• Have played CTF or authored challenges
• Have a good knowledge of the Linux OS
• Understand cloud storage