We are the Center for Biometric Technologies, a technological leader in biometric solutions and one of the key players in the information security market. We create and develop high-load, fault-tolerant government services where architecture and code security are paramount. In connection with the scaling of our secure development division, we are opening a new position.
What you will be doing
You will become part of the AppSec/DevSecOps team and will directly influence the security of final products. The key focus is on building and automating secure development (Secure SDLC) processes and analyzing application security.
Code and Architecture Analysis
- Conduct static analysis (SAST) through both manual code review and automated tools.
- Analyze the results of scanner operations, filter out false positives, and assign tasks to developers for fixing vulnerabilities.
- Participate in the development and approval of application architectures from an information security perspective: perform Threat Modeling (STRIDE, OWASP), identify architectural weaknesses, and defend your expertise with arguments to development teams.
- Perform dynamic application analysis (DAST) using OWASP ZAP.
Automation and CI/CD
- Implement and configure compositional analysis tools (SCA/OSA), manage SBOM.
- Integrate all security check stages into GitLab CI/CD pipelines, develop automation scripts in Python, Go, or Bash.
- Develop and customize rules for static analysis (CodeQL, Semgrep/Opengrep).
Processes
- Build and maintain a secrets management process.
- Develop internal regulatory documents and secure development standards.
- Advise IT teams on writing secure code and eliminating vulnerabilities.
- Validate reports received through Bug Bounty programs and manage their resolution.
Reporting to the Head of Secure Development and Application Architecture. No direct reports initially, but growth to Senior Engineer position is planned as expertise increases.
Requirements
- Higher education in information security.
- At least 2 years of experience as an AppSec or DevSecOps engineer.
- Practical experience with SAST tools (CodeQL, Semgrep, SonarQube, AppScreener, Checkmarx) and SCA (Dependency-Track, Dependency-Check, CodeScoring, AppSec.Track), understanding of SBOM concepts.
- Experience with DAST (OWASP ZAP or similar).
- Proficiency in two or more programming languages at a level sufficient for Code Review and false positive analysis (priority: Java/Kotlin, Go, Python, JavaScript/TypeScript).
- Experience with Secret Management solutions (HashiCorp Vault), experience implementing Secret Management processes.
- Deep understanding of OWASP Top 10 vulnerabilities (2021/2025), their causes, and mitigation methods.
- Understanding of Linux security principles (access models, SELinux, Capabilities, cgroups).
- Experience writing scripts for automation and integrating checks into GitLab CI/CD.
Will be a plus:
- Relevant industry certifications (OSCP, OSWE, GWAPT, CISSP, etc.).
- Experience in securing container environments and orchestration (Docker, Kubernetes).
- Skills in manual security testing (pentesting) and fuzzing.
- Knowledge and understanding of eBPF applicability for security tasks.
Conditions
- Official income – salary + quarterly and annual bonus; terms are open for individual discussion with the successful candidate.
- Voluntary medical insurance with dental care and international insurance.
- Benefits cafeteria (OSAGO compensation, sports equipment, voluntary medical insurance for close relatives, and much more).
- Hybrid work schedule.
- Office located in the city center within walking distance of Novokuznetskaya metro station.
- A dynamic full-cycle team.
- Opportunities for professional and career growth.
