Candidate Expectations

Responsibilities:

• Audit of internal IT systems for compliance with legal requirements
• Development of internal regulatory documentation

Experience Requirements:

Higher education in Information Security, or IT education + a certificate of professional retraining of 512 hours.

Work experience of 1-3 years in Information Security, IT audit, risk management, or related fields.

Direct experience undergoing inspections by FSTEC, FSB, Roskomnadzor, or industry regulators is a significant advantage.

Knowledge of the Russian Federation's regulatory framework (NPA):

1. Federal Law No. 152-FZ "On Personal Data".

2. Federal Law No. 187-FZ "On the Security of Critical Information Infrastructure (CII)" and related acts (orders from FSTEC, regulations).

3. Regulator requirements: Orders from FSTEC of Russia (especially No. 21, 31, 239 for CII, No. 17 for the public sector), requirements of the FSB of Russia (e.g., for cryptographic information security tools, Order No. 514), recommendations of the Bank of Russia (Standard STO BR IBBS).

4. International and national standards: GOST R ISO/IEC 27001 will be a plus

5. Knowledge of PCI DSS, NIST.

Required Competencies:

Audit and compliance assessment:

1. Ability to conduct internal audits of information systems for compliance with legal requirements

2. Information Security risk analysis and protection system assessment.

3. Preparation for external inspections by regulators, accredited organizations, and auditors

Documentation:

1. Compilation and update of organizational and administrative documentation (OAD): policies, procedures, regulations, methodologies.

2. Experience in writing technical specifications (TS) for system modifications.

3. Preparation of compliance reports and conclusions.

Technical Foundation:

1. Understanding of network principles (network protocols, architecture, firewalls).

2. Knowledge of operating systems (Windows, Linux), DBMS.

3. Understanding of cryptography basics and the use of cryptographic information security tools (CIS).

4. Knowledge of main classes of information protection tools (IPT): Antiviruses, SIEM, DLP, IDS/IPS, trusted boot systems, etc.

5. Project Management: Experience in implementing requirements and preparing for certification/attestation projects.

Work Conditions:

• Work in an IT accredited company, with global standards, employment according to the Labor Code of the Russian Federation.
• Absence of bureaucracy.
• Full social package: Voluntary medical insurance (including dentistry), annual fitness compensation.
• Internal and external training programs, career track.
• Performance-based bonuses.
• Work format: hybrid
• Full-time employment.