Information Security Specialist

Information Security Specialist in an IT-accredited company. Responsibilities include auditing internal IT systems for legal compliance and developing internal regulatory documentation. Requires 1-3 years of experience in IS, IT audit, or risk management.

Conduct audits of internal IT systems for compliance with legal requirements; Develop internal regulatory documentation.

Higher education in Information Security, or IT education with a 512-hour professional retraining certificate. Experience: 1-3 years in Information Security, IT audit, risk management, or related fields. Direct experience with inspections by FSTEC, FSB, Roskomnadzor, or industry regulators is a strong advantage. Knowledge of Russian regulatory framework: 1. Federal Law No. 152-FZ "On Personal Data"; 2. Federal Law No. 187-FZ "On the Security of Critical Information Infrastructure (CII)" and related acts (FSTEC orders, procedures); 3. Regulator requirements: FSTEC orders (especially No. 21, 31, 239 for CII, No. 17 for public sector), FSB requirements (e.g., on cryptographic information protection, order No. 514), Bank of Russia recommendations (STO BR IBBS Standard); 4. International and national standards: GOST R ISO/IEC 27001 (plus); 5. Knowledge of PCI DSS, NIST. Competencies: Audit and compliance assessment: ability to conduct internal audits of information systems for legal compliance; analysis of IS risks and assessment of protection systems; preparation for external inspections by regulators, accredited organizations, and auditors. Documentation: drafting and updating organizational and administrative documentation (ORD): policies, procedures, regulations, methodologies; experience writing technical specifications (TS) for system improvements; preparing compliance reports and conclusions. Technical base: understanding of network principles (network protocols, architecture, firewalls); knowledge of operating systems (Windows, Linux), DBMS; understanding of cryptography basics and application of cryptographic information protection tools (CIPF); knowledge of main classes of information security tools (IST): antivirus, SIEM, DLP, IDS/IPS, trusted boot systems, etc.; Project management: experience in implementing projects for compliance and preparation for certification/attestation.

Work in an IT-accredited company with world standards, employment according to the Labor Code of the Russian Federation. No bureaucracy. Full social package: VHI (including dentistry), annual fitness compensation. Internal and external training programs, career track. Bonuses based on performance. Work format: hybrid.