Tasks

• Work with development teams using a shift-left approach to integrate security best practices into the SDLC;
• Conduct security reviews at the design stage and prior to product deployment for both existing and new services;
• Integrate and maintain security processes and tools (SAST, SCA, DAST) within development pipelines;
• Develop and maintain a security architecture blueprint; Define and uphold information security requirements for products;
• Conduct penetration testing, simulating real-world attack scenarios;
• Manage the Bug Bounty program by processing reports from external researchers and overseeing the remediation of vulnerabilities;
• Lead developer awareness programs to educate teams on common security pitfalls;
• Support App Sec tools and services, and engage in research and development (R&D) for SDLC protection methodologies;
• Conduct security risk assessments and threat modeling for applications.

Requirements

• 3–5 years of proven experience as an Application Security Analyst or in a similar role within application security;
• 3+ years of experience with software development methodologies and secure coding practices;
• Strong understanding of common application vulnerabilities, attack vectors, and mitigation techniques;
• 2+ years of experience with security standards and frameworks, such as PCI-DSS and GDPR;
• 2+ years of experience with security tools, including SAST, SCA, DAST, and penetration testing tools;
• Proficiency in at least one programming language, such as Python or Go, with a minimum of 2 years of experience;
• English proficiency at B1+ level (ability to read technical documentation and communicate with international teams);
• Fluent in Russian (at least C1 level).

Nice to have

• OSCP, ISC2 such as CISSP, CCSP or Cloud security certifications are nice-to-have and provide a competitive advantage for the candidate;
• Successful participation in Bug Bounty programs;
• CTF experience;
• Familiarity with OWASP Testing Guide, OWASP Code Review Guide, OWASP Secure Coding Practices;
• Experience working with and supporting Hashi Corp Vault;
• Experience with network vulnerability scanners (Nessus, XSpider, Max Patrol, etc.).

We offer

• Full-time remote work as a Service Provider in the following countries: Bulgaria, Georgia, Belarus, Hungary, Romania, Latvia, Lithuania, Moldova, Azerbaijan, Armenia, Kyrgyzstan, Uzbekistan, Greece, Croatia, Montenegro, Serbia, Kazakhstan, Slovenia, Russia, Cyprus, and Estonia (a valid residence permit is required);
• Competitive remuneration;
• Professional courses;
• Friendly, enjoyable, and positive environment.