Kryptonite is looking for a new full-time employee - a leading specialist in building and scaling SSDLC processes. Currently, these processes are not established.
Work format: 5/2, from 10:00 to 19:00, hybrid 2 days out of 5.
10 min. from Paveletskaya metro station.
Key responsibilities:
- From scratch: building, configuring, and scaling secure development (SSDLC) processes at the company level.
- Integrating AppSec tools (SAST, SCA, DAST, secret scanners) into current CI/CD pipelines as stage checks.
- Managing vulnerability lifecycle: triage, CVSS assessment, configuring filters/exceptions, SLA control, and retest.
- Conducting code and configuration security audits, supporting external audits and pentests.
- Consulting and training development teams, promoting Security by Design practices, fostering a culture of responsible coding.
Requirements (Hard Skills):
- Experience in implementing and configuring SAST/SCA/DAST (Semgrep, Gitleaks, Trivy, Nuclei, OWASP ZAP, SonarQube, SVACE, and similar).
- Deep knowledge of OWASP Top 10, ASVS, CVSS v3, vulnerability types (XSS, SQLi, SSRF, insecure deserialization, logical access errors, etc.).
- Understanding of CI/CD (GitLab CI/GitHub Actions) at the level of configuring checks, not managing pipelines/infrastructure.
- Ability to read code and conduct reviews at the Java/Python/Go/Scala level (at the level of vulnerability detection, not architectural code design).
- Experience with secret management systems (HashiCorp Vault) - an advantage.
Soft Skills & Mindset:
- Ability to explain risks in "developer language" and business language, without acting as a barrier.
- Independent process building in conditions of uncertainty.
- Constructive conflict resolution (security vs. release deadlines).
- Ability to distinguish real business risk from theoretical vulnerability.
Conditions:
- Working in an environment of a modern and complex technology stack:
- CI/CD: GitLab CI, GitHub Actions.
- AppSec Tools: Semgrep, Gitleaks, nuclei, OWASP Dependency-Check.
- Infrastructure: Docker, Kubernetes, Ansible.
- Secret Management: HashiCorp Vault.
- Languages: Scala, Java, Python, Go, Rust.
- Standards: OWASP Top 10, ASVS, CVSS v3.
- Voluntary medical insurance from the first day of employment, IT accreditation.
- Annual salary indexation in accordance with inflation.
- Performance Reviews twice a year. Development of individual development plans for skill improvement and salary growth.
- Standard working day, no on-call duties.
- Professional team with over 5 years of experience in cybersecurity.
- Company gifts for participation in Kryptonite's life, social informal gatherings, and interest clubs (sports, "What? Where? When?", movie buffs, book club).
