3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP.Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules.A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions.Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash.Ability to drive results with teams you don’t manage directly, including through security champions.Interest in LLM application security, such as prompt injection and AI agents’ access to data.Working proficiency in Russian and English.Manual testing with Burp Suite or ZAPStatic analysisDependency scanningSecret detection in codeVulnerability managementOWASP Top 10OWASP API Security Top 10OWASP Top 10 for LLM ApplicationsASVSOur stack:
Languages: PHP (Symfony), Go, JavaScript/TypeScript, PythonData: PostgreSQL, MySQL, ClickHouseCI/CD: Docker, GitLab/GitHub, TeamCitySecurity: SonarQube, NessusOS: LinuxExperience in AdTech or other high-load environmentsDevSecOps experienceExperience testing LLM applicationsBug bounty or CTF experienceOSWE or GWEB certificationWe offer freedom of choice: with us, you'd have a cafeteria benefits system where you can choose which benefits would fit your individual needs.
And, of course, a standard pack of benefits as well: health insurance, fully covered 10 working days of sick leave per year, 5 additional day-offs per year, English and other languages compensation, quarterly, and annual bonuses, corporate events, gifts, gym at the office, also food (yummy!) - you can find snacks in our worldwide working spaces and breakfasts & lunches in the offices!
Please note, that by applying to this position, you confirm your consent to the processing of your personal data for recruitment purposes
