Kontur is an ecosystem for business. Our services help every third company in Russia to make work processes simpler and more efficient: manage accounting, submit reports to government agencies, exchange documents without paper, communicate remotely, and much more. With us, the lives of 3.1 million entrepreneurs and their employees become easier.
About the Team
We are the AI Security team at Kontur's Cyber Defense Center. We are looking for a cybersecurity specialist who will help implement and support AI-based solutions — from product services and RAG systems to internal AI development tools.
Kontur is actively developing the use of AI assistants and agents. Our task is to ensure that these tools are secure and that developers receive a protected result that complies with information security policies, without needing to dive into all the intricacies of information security.
Tasks
- Conduct security analysis (primarily Whitebox) of LLM applications, AI agents, RAG, vector databases, Low-Code/No-Code systems (Dify, n8n), and integrations with external APIs / cloud models.
- Identify AI-specific attack vectors: prompt injection, indirect prompt injection, jailbreak, data poisoning, excessive agency, unsafe tool calls, and over-privileged agents.
- Configure and validate security mechanisms: PII / confidential data filters, context limitations, rate limiting, tool call control, and manual confirmations for critical operations.
- Strengthen internal AI/ML tooling in collaboration with platform teams. Build a system of rules, skills, and hooks to embed information security policies directly into the development environment: skills, rules, hooks, MCP servers.
- Verify the security of local LLM and agent execution in Kubernetes and Linux sandboxes: session isolation, memory, containers, RBAC, NetworkPolicy, Secrets Management.
- Formulate requirements for auditing and tracing AI systems: trace ID, prompt/response logging, logging model calls and agent actions.
- Advise teams, help implement secure code, and build understandable processes.
We Expect
- At least two years of experience in information security in one or more areas: AppSec, DevSecOps, Cloud/K8s Security, Product Security, or ML Security.
- Proficiency in one of the programming languages: Python, Go, C#, TS, Rust. Ability to read others' code, find vulnerabilities, and write PoCs.
- Knowledge of the AI/LLM stack: understanding the architecture of language models, RAG, vector databases (Milvus, Qdrant, pgvector, etc.), AI agents, agent memory, tool calling, and the MCP interaction standard.
- Knowledge of AI threats: understanding the risks of OWASP for LLM, MITRE ATLAS (prompt injection, system prompt disclosure, data leaks, reckless execution of agent code).
- Knowledge of Linux fundamentals and a basic understanding of Kubernetes security: RBAC, ServiceAccount, NetworkPolicy, Secrets, container isolation.
- Knowledge of classic web vulnerabilities, authentication and authorization mechanisms OAuth2, OIDC, JWT, RBAC, and secure development — Secure SDLC, Threat Modeling.
- Ability to provide well-reasoned explanations of risks and find compromises with development.
We Offer
- Hybrid work format in Yekaterinburg. Office at Maloprudnaya street, 5. We provide everything you need: equipment, a workspace, a library with professional literature, a relaxation area, and a kitchen area with fruits and snacks.
- Income level depends on your technical knowledge and skills. We regularly review salaries considering professional growth. Financial bonuses are also available.
- Strong engineering community. We regularly hold internal technical conferences and share experiences between teams. You will always find someone to consult with.
- Opportunity to change products, teams, or subject areas within the company. We support development in any direction.
- Communication on a "you" basis and a maximum of horizontal connections in the team to agree and resolve work tasks faster.
- Opportunity to share expertise. We help with speaking at conferences, participating in podcasts or videos, and writing articles.
- Support for professional development. We organize internal and external training.
