MTS Bank is a team that develops digital financial services and makes them accessible to everyone.
We work with a modern technology stack, high-load systems, and cloud infrastructure, implementing best engineering practices. This approach allows us to create reliable solutions for business and customers.
Responsibilities
- analyze the architecture of new and developing systems, identify risks, and define information security requirements
- verify the completeness, applicability, and compliance of information security requirements with architectural principles, internal standards, and regulatory requirements
- prepare architectural conclusions, recommendations, and improvement plans based on audits, pentests, and scans
- participate in the design of security subsystems: network protection, authentication and authorization, web application protection, logging and monitoring
- advise project teams on implementing information security requirements and monitor their integration into the solution architecture
- analyze attack scenarios using MITRE ATT&CK and Cyber Kill Chain; develop and update threat models within the adopted methodology
Candidate Requirements
- 3+ years of experience in information security, including experience in designing or analyzing the architecture of secure systems
- experience working as an Information Security Architect, Lead Information Security Specialist, Information Security Engineer, or AppSec Specialist
- ability to work with architectural diagrams, technical specifications, project, and operational documentation
- understanding of the operating principles of key types of security tools: NGFW/FW, WAF, IDS/IPS, DLP, VPN, SIEM, sandboxes, email and web access protection tools
- knowledge of AppSec practices, OWASP, and Secure SDLC approaches; understanding the role of information security in CI/CD and DevOps processes
- knowledge of regulatory requirements and the regulatory framework in information security applicable to the company and its products
- ability to justify information security requirements to technical teams and find proportionate protection measures
