We are looking for an AppSec Technical Lead — a strong hands-on expert in Application Security, who will be the technical leader of a team of 3 AppSec engineers.
You will develop secure SDLC and DevSecOps practices, work with SAST/SCA/DAST/MAST, and develop automation for security checks.
Your responsibilities:
- Be the technical leader for the AppSec engineers team
- Help the team make architectural and technical decisions in the field of Application Security
- Mentor engineers, help them develop expertise in AppSec, DevSecOps, security code review, and automation
- Review technical solutions, vulnerability analysis approaches, SAST rules, and security automations
- Participate in team planning together with the Product Owner
- Help prioritize tasks considering technical risks, business context, and team workload
- Be the single point of contact for the product PO on AppSec issues: statuses, blockers, risks, roadmap, technical limitations, and team needs.
- Develop the integration of security checks into CI/CD
- Develop and maintain rules for SAST tools
- Improve processes for working with SAST/SCA/DAST/MAST: check quality, triage, reporting, reduction of false positives
- Write automation for scanner integration, result processing, finding enrichment, and metric generation
- Research and test new application security assessment tools
- Help make security checks more useful for developers and less noisy for teams.
What is important to us:
- 4+ years of experience in Application Security or comparable development experience with a subsequent transition to security
- Practical experience in technical leadership, mentoring, or coordinating the work of AppSec/security engineers
- Deep understanding of secure SDLC, shift-left security, and DevSecOps
- Practical experience with SAST, SCA, DAST, and/or MAST tools
- Experience integrating security checks into CI/CD
- Experience with security code review in one or more languages: Java/Kotlin, Go, Python
- Confident command of one of the languages: Python/Java/Go
- Experience with Bash
- Deep understanding of OWASP Top 10, OWASP ASVS, and OWASP Mobile Top 10
- Understanding of modern architectures: microservices, REST/gRPC API, Kubernetes, containerization
- Experience analyzing scan results, validating vulnerabilities, searching for false positives, and prioritizing risks
- Practical experience interacting with developers on vulnerability remediation
- Understanding of mobile application security specifics
- Experience with MAST tools
- Understanding of typical mobile application risks: insecure storage, insecure communication, improper secrets management, jailbreak/root detection, reverse engineering risks, certificate pinning, tampering
- Experience analyzing Android/iOS applications will be an advantage.
We offer:
- Comfortable modern office
- Office-based work format
- Annual salary review, annual bonus
- Corporate gym and relaxation areas
- Over 400 educational programs from SberUniversity for professional and career development
- Adaptation program and supervisor support at the start
- Extended VHI (Voluntary Health Insurance), preferential insurance for family, and corporate pension program
- Flexible mortgage discount equal to 1/3 of the Central Bank's key rate
- Free SberPrime+ subscription, discounts on partner company products
- Referral bonuses for recommending friends to join Sber.
