AppSec Engineer

AppSec Engineer at Sber2B in Moscow. Salary discussed at interview. Responsibilities include security auditing, SAST/DAST/SCA, risk assessment, and supporting development teams.

Responsibilities: • Work with secure development tools SAST, DAST, SCA, ASOC, MAST; • Conduct security audits of company applications and services; • Assess risks and develop measures to mitigate them; • Identify critical components of automated systems and prioritize protection; • Interact with and support development teams on information security and secure development practices; • Approve releases and participate in security incident response; • Triage software vulnerabilities; • Conduct software scanning.

• Understanding of modern application security testing methods (SAST/DAST/IAST/SCA/Penetration Testing); • Experience in identifying and eliminating common vulnerabilities (XSS, SQL Injection, CSRF); • Practical experience in source code analysis for weaknesses and potential threats; • Proficiency in static and dynamic security analysis tools (Burp Suite, OWASP ZAP, SonarQube, Veracode, etc.); • Knowledge of web application and API security assessment methodologies; • Skills in developing recommendations to improve application security; • Experience in vulnerability triage and interacting with development teams.