Specialist in Information Security (AppSec)

Action Tech is hiring an AppSec Specialist for full-time remote work. Responsibilities include integrating SSDLC/DevSecOps, managing SAST/DAST/SCA tools, and conducting vulnerability triage.

Responsibilities: - Integrate and support SSDLC / DevSecOps processes in CI/CD - Configure and develop SAST, DAST, SCA, Secret Detection tools, reduce false positives - Conduct vulnerability triage: assess risks, prioritize tasks, recommend fixes, and verify fixes - Participate in code and architecture review from a security perspective, conduct threat modeling - Advise developers on secure development practices - Audit secure development processes and practices

Requirements: - Self-sufficient, persuasive, ambitious, with leadership qualities (or ability to manage without formal authority), striving to build a secure infrastructure - At least 1 year of experience in AppSec / information security development - Understanding of OWASP Top 10, main vulnerability classes, exploitation and protection methods - Practical experience with SAST/DAST/SCA tools, e.g., Semgrep, Burp Suite, ZAP, Trivy, Dependency-Check - Automation skills in Python or Bash - Confident work with Git / GitLab - Ability to clearly present work results and find common language with developers - Ability to read and write code in at least one language: Python, Go, PHP, C# Nice to have: - Commercial development experience - Experience with Docker / Kubernetes in security context - Experience with SonarQube, Jenkins, Ansible, Nexus - Knowledge of Cloud Security and IaC scanning - Experience with Terraform, Checkov, tfsec, OPA/Kyverno

Full-time employment. Work format: remote possible.