DevSecOps Specialist

DevSecOps specialist at Red Soft, salary up to 300k (net), located in St. Petersburg, focusing on fuzzing and security testing.

Setting up and conducting fuzzing of system and application software using AFL++, libFuzzer, and similar tools. Preparing fuzzing environments: building projects with instrumentation, configuring compilers, sanitizers, and launch parameters. Analyzing source code and application architecture to select fuzzing targets, identify entry points, and prepare harness wrappers. Configuring code coverage collection and analysis, evaluating fuzzing efficiency, and optimizing performance. Integrating fuzzing into CI/CD pipelines, developing scripts and reusable components for automation. Performing static and dynamic analysis using SAST/DAST tools, validating results, and filtering false positives. Analyzing third-party dependencies with SCA tools and searching for secrets in source code. Participating in SSDLC improvements and supporting GOST R 56939-2024 requirements.

Solid knowledge of Linux, command line, and debugging tools. Practical experience with fuzzers like AFL++ or libFuzzer. Understanding coverage-guided fuzzing, input mutation mechanisms, and coverage impact. Experience building projects with instrumentation, using compilers and sanitizers like AddressSanitizer and UndefinedBehaviorSanitizer. Programming skills in Python and/or Bash. Experience with CI/CD systems (Jenkins, GitLab CI, GitHub Actions) and test automation. Understanding static analysis principles and ability to verify automated tool results. Nice to have: experience with parallel/distributed fuzzing infrastructure, coverage analysis tools (afl-cov, gcov, llvm-cov), fuzzing system libraries, network services, parsers, protocols, or databases; SAST tools (Svace, Semgrep, CodeQL, SonarQube, Bandit); DAST tools, Valgrind and sanitizers; Trivy, Dependency-Track, Gitleaks, TruffleHog.

Salary up to 300,000 rubles (net). Location: St. Petersburg (Electrosila metro). Office work.