for a banking project in the Yuztech team.
Salary: up to 534,388 RUB gross (before tax)
Location: Russian Federation
Format: remote
Employment: Yuztech staff
Requirements:
- Higher IT education, preferably with a specialization in Information Security (IS)
- At least 4 years of practical experience in security analysis and architectural documentation analysis
Knowledge:
- Fundamentals of Information Security (protocols, information security tools, their purpose, PKI infrastructure, and understanding of cryptographic algorithms' operation)
- Application Security: ability to find and fix web vulnerabilities from OWASP Top 10, OWASP Mobile Top 10, CWE Top 25
- Information Systems Architecture Expertise: ability to find errors/vulnerabilities at the project documentation level, including business process logic, and propose relevant protection mechanisms and tools
- Technologies for building application systems, including microservices and containerization
- Code analysis and programming
- Principles of modern web applications, CI/CD processes, and Secure Software Development Lifecycle (SSDLC)
- Typical practices for enhancing web application security
- Regulatory requirements in the field of Information Security
- Risk-based approach methodology, ability to conduct qualitative risk assessment and develop threat scenarios
- Professional proficiency in Burp Suite (ability to use custom extensions, build multi-level attacks, and combine techniques)
Will be a plus:
- Experience in CTFs, bug bounty programs
- Certifications: OSCP, OSWE, Portswigger Web Security Academy, CEH, CISSP
- Experience writing vulnerability search rules in CodeQL
- Proficiency in at least one programming language (Java, Python, Go)
Responsibilities:
- Participate in task elaboration from an Information Security perspective at all stages of the project lifecycle
- Conduct security analysis of solution architectures and participate in the approval of project documentation
- Model threat scenarios and participate in the approval of new and review of existing risks
- Analyze development team plans and backlogs, present requirements and recommendations for new features
- Participate in investigations upon identification of IS incidents
- Provide expert support to development teams on IS issues, secure coding practices, IS architecture design, and security requirements implementation
- Conduct Code Reviews based on analysis results to identify and fix vulnerabilities
- Process scan results from secure development tools to identify and fix vulnerabilities
- Prioritize vulnerability backlogs and monitor their remediation
Contacts: recruiter contact
