ITD Group is a group of companies that has been actively promoting information security solutions in Russia and the CIS markets for over 15 years.
One of our focus areas is the development of information security solutions. The SASTAV team is developing the AppSec domain and is engaged in the development of products for static code analysis. The solution is used by the largest companies in Russia and is in the stage of active development.
Now we are expanding the team and looking for a specialist who will develop the product: develop and improve vulnerability detection rules, increase the accuracy and coverage of checks, and participate in the development of static analysis tools.
Responsibilities:
- Develop and improve SAST rules;
- Research vulnerabilities in source code: analyze causes, exploitation conditions, and methods of automatic detection;
- Analyze scan results, identify causes of false positives and misses, increase accuracy and coverage of checks;
- Create test cases with vulnerable and secure code and maintain test sets for rule quality verification;
- Prepare descriptions of findings and recommendations for vulnerability remediation;
- Collaborate with analyzer developers to define necessary engine capabilities for improving checks.
What we are looking for:
We consider specialists of different levels — from junior specialists to experienced engineers. Practical experience with SAST tools is important for a higher position.
- Practical experience in AppSec: finding and analyzing vulnerabilities in source code, conducting security code reviews;
- Understanding of common vulnerability classes, their exploitation conditions, and remediation methods;
- Understanding of static analysis fundamentals: data flow, untrusted data sources, dangerous operations, and sanitization;
- Ability to translate vulnerability descriptions into automatic check conditions and verify them with vulnerable and secure examples;
- Skills in working with Git, automated tests, and code reviews;
- Knowledge of one of the web frameworks;
- Practical experience with SAST tools for a higher position.
Desirable skills:
- Practical experience with SAST: analyzing findings, identifying false results, understanding the causes of misses;
- Experience in developing rules for SAST, e.g., Semgrep or CodeQL, or for your own analyzer;
- Experience with taint analysis, interprocedural analysis, and modeling the behavior of libraries and frameworks;
- Experience in systematic evaluation of static analysis quality on test sets and real projects;
- Experience in vulnerability research and preparing minimal examples demonstrating the problem;
- Familiarity with SCA, direct and transitive dependencies, and package manager ecosystems;
- Understanding of reachability analysis: building a call graph and determining if an application can call vulnerable dependency code.
We are happy to offer:
- Official employment in an accredited IT company according to the Labor Code of the Russian Federation;
- Remote work within the Russian Federation, and also the opportunity to work in a cozy office near Belorusskaya metro station.
- 28 + 3 days of vacation per year;
- Flexible benefits package: we offer a choice of medical insurance with dental care, a sports subscription, or reimbursement for language courses;
- All necessary work equipment;
- Opportunities for training at the company's expense;
- A truly friendly team of 100+ great people who are passionate about their work, and in their free time ride unicycles, tune cars, collect hunting rifles, and do many other things, which they will gladly tell a new colleague about over morning coffee :)
