Hi! This is the product security team.
Today, it is hard to imagine any large business without a cohesive and competent information security team. Ozon is no exception.
We are currently looking for a new colleague to join the Product Security team, who will complement the existing team and participate in secure development processes.
You will
- Implement ML/LLM for vulnerability detection in code and improve existing tools
- Implement Code Review practices
- Develop security requirements for the code, applicable to internal service products or the OzonID authentication system
- Develop security controls other than typical SAST/DAST/SCA
- Conduct security audits of services and assist in remediating identified vulnerabilities
- Advise development teams on security matters
- Work on projects that significantly enhance the security level of users and employees - improving authentication system security, inventorying service changes
What's important to us
- Understanding of the Secure Software Development Lifecycle (Secure SDLC)
- Practical experience in application analysis
- Understanding the causes of vulnerabilities and their exploitation principles
- Understanding the principles of mitigating major threats from OWASP Top 10, CWE Top 25
- Experience in threat modeling
- Experience implementing security requirements in a company
- Experience conducting security code reviews
- Proficiency in Linux as a confident user
- Familiarity with security standards in software development (OWASP/MITRE/BSIMM)
- Ability to write code in any of the languages: Go/Python/Java/C#/JavaScript.
Will be a plus
- Experience implementing ML/LLM in security tasks/solving routine tasks
- Experience managing large security projects, for example, implementing Istio, inter-service authorization/authentication, NetworkPolicy in k8s, antiSSRF proxy, Content Security Policy, or developing security training programs for employees, or other project examples
- Experience leading a team or mentoring interns/new employees
