We are looking for an Application Security Engineer to join a team that develops internal security tools for development. This is a role at the intersection of application security, development, and DevSecOps: you will not only identify risks but also transform security requirements into convenient automated checks integrated into the daily development process. The team develops and implements tools that help identify security issues at various stages of the development lifecycle: at the source code, dependency, interface, mobile application, and delivery process levels. The role involves a significant engineering component: designing checks, researching approaches, integrations, and developing enterprise solutions for SAST, SCA, DAST, MAST, and related areas.
Your responsibilities will include:
- developing application security checking tools integrated into the development process
- developing, maintaining, and improving automated security checks for various types of tasks: analysis of source code, dependencies, secrets, APIs, and other development artifacts
- designing and implementing integrations of security tools into CI/CD and development processes
- developing and maintaining rules and automation for SAST, SCA, DAST, MAST, and related practices
- integrating security tools into the secure SDLC and CI/CD in a way that is useful for developers and does not create unnecessary work complications
- conducting threat modeling and security reviews of new features, services, and architectural solutions at early stages
- validating scanning results, filtering false positives, and prioritizing vulnerabilities by technical and business risks to configure rules and automation
- assisting development teams in remediating vulnerabilities: explaining causes, risks, and remediation options in understandable engineering terms
- identifying areas where manual expertise can be transformed into automated checks
- participating in research and development of new application security approaches and tools based on team and company needs.
What is important to us:
- at least 2 years of practical experience in application security, product security, or DevSecOps, or software development experience with a significant shift towards security
- proficient in at least one programming language for development and automation: Python/Go/Java will be an advantage
- understanding of secure SDLC and practices for early integration of security into the development process
- experience with tools and approaches in the areas of SAST/SCA/secret scanning/API
- experience integrating security checks into CI/CD
- practical experience in source code security analysis and understanding of common vulnerabilities for at least some of the following stacks: Java, Go, Python, JavaScript/TypeScript, PHP, C/C++
- good understanding of OWASP Top 10, OWASP ASVS, and principles of secure API development
- understanding of modern architectures: microservices, REST/gRPC, Kubernetes, containerization
- ability to independently research a problem, propose an engineering solution, and bring it to a working result.
Will be a plus:
- experience in developing or modifying plugins for IDEs, linters, static analyzers, or internal developer tools
- practical experience in API security
- experience building enterprise solutions or internal security platforms
- knowledge of approaches to checking API contracts and implementation compliance with specifications
- experience with threat modeling approaches
- knowledge in the field of mobile application security: OWASP Mobile Top 10, MASVS, OWASP MASTG
- practical experience in analyzing and testing mobile application security using tools like jadx, apktool, MobSF, and similar
- participation in bug bounty programs, CTFs, or open-source projects
- experience in identifying and reducing false positives in security tools
- instrumental use of AI for analysis, generation, and automation.
What is important in this role:
- ability to speak the same language as developers and help them solve problems, not just pass on found issues
- engineering mindset: it is important for us not only to identify a risk but also to embed protection into the process so that it actually works at scale
- ability to balance the depth of security analysis with the usability for internal users of the tools.
We offer:
- comfortable modern office
- office work format
- annual salary review, annual bonus
- corporate gym and recreation areas
- over 400 educational programs from SberUniversity for professional and career development
- adaptation program and manager support at the start
- extended voluntary medical insurance, preferential insurance for family, and corporate pension program
- flexible mortgage discount equal to 1/3 of the Central Bank's key rate
- Prime subscription with the possibility of sharing with three close ones
- reward for recommending friends to the Sber team.
