Specialist in Information Security (SIEM SOC EDR WAF KWTS)

Senior Information Security Specialist at EGAR, full-time, office in Moscow. Responsible for KWTS, WAF, honeypot, and SOC incident response.

Responsibilities: Control and support KWTS: web filtering policies, antivirus scanning, anti-phishing, SSL/TLS inspection, URL categories, file type control. Detect and eliminate bypass routes: direct internet access, unaccounted proxies, alternative DNS, unauthorized VPN, mobile hotspots. Monitor coverage of web traffic for users and servers via KWTS or another approved gateway. Process KWTS events: blocks, threats, phishing, bypass attempts, SSL/TLS inspection errors, administrative actions. Configure and support honeypot: deployment, decoys, simulated services, log collection, alerts, event correlation. Develop and maintain playbooks for honeypot triggers: verification, localization, evidence collection, analysis, escalation, IOC blocking. Pass IOC to SIEM/SOC, EDR, IDS/IPS, WAF, email and web gateways for blocking and retrospective search. Control and support WAF: rules, exceptions, signatures, updates, backups, rollback of changes. Protect web applications and APIs: SQLi, XSS, RCE, SSRF, LFI/RFI, path traversal, command injection, brute force, scanning, bots, DDoS. Set up positive security model for critical APIs: allowed URLs, methods, parameters, request formats, file types. Manage WAF changes: requests, approvals, risk assessment, testing, rollback, change log. Monitor receipt of logs from KWTS, honeypot, and WAF to SOC: queries, triggers, blocks, policy changes, administrative actions. Investigate incidents: collect evidence (logs, dumps, hashes, timestamps), analyze, escalate, corrective actions. Control access rights to KWTS, honeypot, and WAF consoles: role model, MFA, PAM, least privilege. Periodically review exceptions and allow rules; revoke expired and irrelevant ones. Prepare regular reports on KWTS, honeypot, and WAF. Initiate unscheduled audits during mass attacks, critical failures, changes in infrastructure, or regulatory requirements.

Experience in information security over 6 years (preferably in a bank for 3+ years or financial organization). Practical experience in operating or controlling KWTS, proxy servers, web filtering systems. Understanding of SSL/TLS inspection, URL categories, reputation analysis, anti-phishing. Experience with SIEM/SOC: event correlation, alerts, playbooks, incident response. Experience deploying or supporting honeypot (preferred). Practical experience with WAF: rules, exceptions, defense against SQLi, XSS, RCE, SSRF, bots, DDoS. Understanding of API protection principles and positive security model. Knowledge of change management, detection mode testing, and rollback. Understanding of AD/LDAP, SIEM, SOC, Service Desk, Jira. Knowledge of Federal Law 152-FZ, GOST R 57580.1, and Bank of Russia requirements for information security and personal data protection. Understanding of banking and commercial secrecy, rules for working with personal data. Experience in handling and investigating information security incidents. Experience maintaining registries, logs, and reporting. Knowledge of role model, least privilege, MFA, PAM. Experience with honeypot. Experience integrating WAF with SIEM/SOC. Experience conducting investigations of web attacks. Experience with cloud and on-premise WAF. Information security certifications (KWTS, WAF, SIEM/SOC, 152-FZ, GOST R 57580.1).

Full-time employment. Office format in Moscow.