AppSec Technical Lead

AppSec Technical Lead at Sber (Moscow). 4+ years experience. Salary: 300,000 - 450,000 RUB. Lead a team of AppSec engineers, drive security integration into CI/CD.

Responsibilities: • Be the technical leader for a team of AppSec engineers. • Help the team make architectural and technical decisions in Application Security. • Mentor engineers, helping them develop expertise in AppSec, DevSecOps, security code review and automation. • Review technical solutions, vulnerability analysis approaches, SAST rules and security automations. • Participate in team planning together with the Product Owner. • Help prioritize tasks considering technical risks, business context, and team load. • Be the single point of entry for the product PO on AppSec matters: statuses, blockers, risks, roadmap, technical limitations and team needs. • Develop integration of security checks into CI/CD. • Develop and maintain rules for SAST tools. • Improve processes with SAST/SCA/DAST/MAST: check quality, triage, reporting, reduction of false positives. • Write automation for integrating scanners, processing results, enriching findings, and generating metrics. • Research and test new application security testing tools. • Help make security checks more useful for developers and less noisy for teams.

Requirements: • Experience in Application Security from 4 years, or comparable experience in development with a subsequent transition to security. • Practical experience in technical leadership, mentoring, or coordinating the work of AppSec/security engineers. • Deep understanding of secure SDLC, shift-left security, and DevSecOps. • Practical experience with SAST, SCA, DAST and/or MAST tools. • Experience integrating security checks into CI/CD. • Experience with security code review in one or more languages: Java/Kotlin, Go, Python. • Strong command of one of the languages: Python/Java/Go. • Experience with Bash. • Deep understanding of OWASP Top 10, OWASP ASVS, and OWASP Mobile Top 10. • Understanding of modern architectures: microservices, REST/gRPC APIs, Kubernetes, containerization. • Experience analyzing scan results, validating vulnerabilities, finding false positives, and prioritizing risks. • Practical experience interacting with developers to fix vulnerabilities. • Understanding of mobile application security specifics. • Experience with MAST tools. • Understanding of typical mobile app risks: insecure storage, insecure communication, mishandling of secrets, jailbreak/root detection, reverse engineering risks, certificate pinning, tampering. • Experience analyzing Android/iOS applications will be an advantage. • Instrumental use of AI for analysis, generation, and automation.