AppSec Engineer

Right Line, a Russian IT company since 2017, seeks an Application Security Engineer to integrate security into all SDLC stages. Salary: 300,000 net. Responsibilities include vulnerability assessments, threat modeling, and SSDLC development.

We are Right Line, a Russian IT company operating since 2017. We develop solutions for banks and financial companies. We are developing secure development practices for the company's internal products and are looking for an Application Security Engineer to help integrate security into all stages of the SDLC - from design and development to operation. Responsibilities: • Conduct security assessments of applications and services for vulnerabilities (SAST, SCA, DAST, secret detection, fuzzing), prepare POC exploits and clear reports for teams; • Perform vulnerability triage: risk and impact assessment, prioritization, task assignment for remediation, control deadlines and quality of vulnerability fixes; • Participate in design: conduct threat modeling (e.g., STRIDE), security architecture and design reviews, formulate requirements for authentication, authorization, encryption, and logging; • Develop SSDLC and DevSecOps: define and implement security controls at requirements, design, development, testing, and operation stages, configure security gates in GitLab CI/CD; • Maintain and develop AppSec tools: integrate scanners into the development pipeline, configure policies, exceptions, and reporting, participate in selection and pilots of new solutions; • Participate in security audits of services and incident investigations: analyze causes, develop sustainable measures to prevent recurrence of entire classes of vulnerabilities; • Consult development teams and architects on secure development, vulnerability analysis and remediation, secure coding patterns; • Conduct trainings, workshops, and seminars on AppSec (OWASP Top 10 / API Security, secure authentication and session management, API and integration protection, etc.); • Research new attack vectors and trends in AppSec, propose improvements to processes and tools.

• Higher technical education (preferably in information security or comparable practical experience in application development/security); • At least 3 years of experience as an application security engineer, participation in real projects to protect web or API services in production; • Practical experience in implementing and operating tools: SAST, SCA, DAST, fuzzing, secret scanning. Integration of these tools into CI/CD (preferably GitLab CI/CD); • Experience with Docker, Kubernetes, GitLab (or similar version control and CI/CD systems); • Ability to conduct code reviews with a security focus, provide clear and practical recommendations to developers; • Proficiency in one of the programming languages (Python / Go / Bash); • Deep understanding of the causes and exploitation methods of vulnerabilities from OWASP Top 10 and OWASP API Security, as well as practical remediation of these issues; • Communication skills: ability to explain complex technical risks in clear language, negotiate priorities, constructively defend security position; • Willingness to take responsibility for results: from the quality of found vulnerabilities to ensuring the team actually implements sustainable fixes, not workarounds; • Preference is given to candidates with experience in transactional business or payment systems, with a deep understanding of payment technologies and specifics of working in B2B/B2G segments.

Salary: 300,000 net