Lead Application Security Engineer

Lead Application Security Engineer at SOGAZ (Moscow). Salary discussed at interview. Focus on secure development lifecycle and web application security.

Responsibilities: Develop cycle and processes of secure development (S-SDLC) in terms of static analysis of Web applications (processes, automation); Ensure protection of developed and used applications; Conduct security audits of developed services (manual analysis, static code analysis, secret search); Participate in designing secure architecture of developed products; Form and formalize security requirements for products; Advise developers and control elimination of detected vulnerabilities; Develop, implement, and support systems and processes of information security in terms of static code analysis and vulnerability search; Train employees on information security requirements in development.

Ability to independently identify vulnerabilities in Web applications; Understanding of CI/CD cycles (Gitlab-CI) and DevOps; Understanding of operation and configuration of rules and tools for static analysis of Web applications; Expert knowledge of Client-Side and Server-Side vulnerabilities (OWASP TOP-10 and a bit more); Understanding at least one programming language (preferably Java and Python); Understanding of authentication and authorization systems (PKI, LDAP, OAuth, SAML, 2FA); Knowledge of Bash, Docker, Python or Go; Ability to read code and identify errors; Experience with vulnerability scanners (Burp Suite, OWASP ZAP).

Office work in Moscow. Salary discussed at interview.