We are a team of offensive security specialists. We conduct penetration tests of web applications, internal infrastructures, and Red Team operations for companies in the financial sector, e-commerce, and telecom. We are looking for someone who is interested in digging into application logic, finding non-standard attack vectors, and doing it manually, not just with tools.
Responsibilities
- Manual web application testing for vulnerabilities (Black box, Grey box)
- Searching for and exploiting SQLi, LFI/RFI, SSRF, SSTI, Command Injection, and other classic web vulnerabilities
- Working with Burp Suite: intercepting and modifying requests, Intruder, Repeater, extensions
- WAF bypass: manual tampering, finding and writing tamper scripts
- Working with automated tools: sqlmap, ghauri — with an understanding of what's happening under the hood
- Writing clear reports with PoC, criticality assessment, and remediation recommendations
Must-haves:
- Solid understanding of web vulnerabilities: SQL Injection (including blind boolean/time-based), LFI/RFI, SSRF, SSTI, CMDi — how they occur and how to find them in practice
- Knowledge of the specifics of major DBMS: MySQL, PostgreSQL, MSSQL
- Experience with Burp Suite (Intercept, Repeater, Intruder, extensions)
- Basic Linux skills: navigation, permissions, processes, networking
- Understanding of how sqlmap and ghauri work
- Basic experience with shells and reverse shells
Will be a plus:
- Completing PortSwigger Web Security Academy
- Activity on HackTheBox / TryHackMe
- Experience writing tamper scripts or extensions for Burp
- Understanding of WAF operation and bypass mechanisms
What we offer:
- Office near Novocherkasskaya metro station
- Lunches covered by the company
- Salary without a ceiling — discussed based on your actual level
- Young and friendly team
- Work on real commercial projects
How to apply
Briefly tell us about yourself: what you've worked on, what you've studied. Attach your GitHub, writeups, articles, or analyses of web applications — all of this will be a plus.
