Загрузи резюме, чтобы видеть мэтчи с вакансиейЗагрузи резюме, чтобы видеть мэтч с вакой
подготовься к отклику
ai-инструменты
Чтобы адаптировать резюме под вакансию или составить сопроводительное письмо, загрузи резюме
описание
Distribusion operates a ground transportation marketplace that gives travellers online access to search for and purchase tickets. Its B2B technology platform connects bus, rail, and ferry operators in over 70 countries with online retailers.
задачи
Lead threat modeling and secure design reviews for high-risk changes, partner integrations, and payment flows
Implement, tune, and enforce security gates in GitLab CI/CD, including SAST, SCA, secrets scanning, and DAST, while minimizing developer friction
Triage, reproduce, and prioritize findings from bug bounties, partner penetration tests, and automated scanners as the primary technical owner
Work with the DevOps team to implement GCP organizational policies, least-privilege IAM architectures, and Cloud Armor WAF and rate limiting
Establish a security-champions network across engineering squads and use automation and AI-assisted tooling to scale code reviews
Own end-to-end vulnerability management, including a risk-ranked backlog, remediation SLAs, an escalation path, and closing findings with teams
Scope and coordinate the annual external penetration test and produce secure-development evidence for PCI-DSS and ISO 27001
требования
5+ Years of AppSec experience, or 3+ years plus a strong software engineering or web penetration testing background
Track record of taking ownership
Ability to read and write production code in languages such as Python, Go, TypeScript, or Ruby
Deep understanding of web frameworks, CI/CD, and Kubernetes
Deep knowledge of web and API security, including OAuth2, JWT, rate limiting, tenant isolation, IDOR, and XSS
Strong cloud security fundamentals, preferably GCP, including public exposure, secrets hygiene, and WAF rules
Experience running threat modeling and secure design reviews on real systems, using STRIDE or similar
Hands-on experience with SAST, SCA, and secrets scanning in CI, using Aikido, Semgrep, Snyk, or similar
Ability to prioritize real-world risk, propose trade-offs, and communicate complex risks clearly to engineers and leadership
Будет плюсом: experience securing high-volume, multi-tenant B2B APIs, using AI tooling to accelerate triage and review
условия
Competitive salary
Flexible work policy with the option to work remotely and international opportunities as the company expands globally
