Information security engineer in e-commerce

Overgear is an international e-commerce platform for gamers. We help players save time while enabling professional gamers to monetize their expertise. Since 2017, we've been building a product for the global market, serving customers across the US, Europe, and beyond. Gamers around the world trust Overgear — we have 34,000+ Trustpilot reviews with a 4.9/5 rating, and our annual sales volume exceeds $25M GMV. We are now looking for a Senior Information Security Engineer who will take ownership of product and infrastructure security at Overgear: assess current risks, establish protection processes, and help make security an integral part of development.

• Assess the current state of information security, identify key risks, and create a one-year security roadmap.
• Find and remediate vulnerabilities in web applications and APIs (REST, GraphQL), including the business logic of payments, orders, and payouts.
• Strengthen infrastructure security: Cloudflare / WAF, Kubernetes, internal services, admin panels, SSO, and secrets management.
• Establish incident detection and response processes: logging, monitoring, alerts, investigations, and postmortems.
• Integrate security into development processes: CI/CD checks, dependency and supply chain security, and standards for secure development and working with AI agents.
• Work with the antifraud team to protect customer and service provider accounts against account takeovers, phishing, fraud, and compromised payouts.
• Manage access security for employees and contractors: MFA, SSO, permissions management, and timely access revocation.
• Organize external penetration tests, establish a vulnerability reporting process, and improve security awareness across teams.

• 4+ years of experience in AppSec, Product Security, Cloud Security, penetration testing, or development / DevOps with strong security expertise.
• Deep practical understanding of OWASP Top 10 and API Security Top 10, including business logic vulnerabilities that are difficult to detect with automated scanners.
• Ability to read and write code, preferably TypeScript / Node.js, with experience writing scripts in Python or Go.
• Experience with Linux, Docker, Kubernetes, cloud and edge services (Cloudflare, AWS, or equivalents), and an understanding of networks and TLS.
• Knowledge of OAuth 2.0 / OIDC, authentication and authorization principles, and common implementation mistakes.
• Hands-on incident investigation experience: log analysis, timeline reconstruction, threat containment, and postmortems.
• Ability to independently assess risks, set priorities, and explain technical decisions to the development team and the business.
• Fluent Russian for work; English at B2 level or above.
• Будет плюсом: Experience in e-commerce, fintech, marketplaces, or gaming, especially with antifraud, payment protection, KYC, and chargebacks; Participation in bug bounty programs, CVE discovery, CTFs, or speaking at industry conferences; Experience with IAM/SSO, GraphQL, Next.js, low-code platforms, and monitoring / detection systems (Grafana/Loki, Datadog, SIEM); Understanding of LLM and AI agent risks, and practical experience with PCI DSS and GDPR

• At Overgear, you will not just maintain existing security policies: you will build the information security function yourself and see the real impact of your decisions on the business.
• Our bar is high, but clear. We trust people's expertise, give them room to make independent decisions, and value ownership, systems thinking, and measurable results.
• Global scale — an international product trusted by customers around the world
• Impact on the product and processes — the opportunity to build security from the ground up, set technical priorities, and work directly with the CTO
• Data-driven culture — decisions are based on analytics, experimentation, and measurable impact
• Remote-first environment — work from anywhere with a focus on outcomes rather than location
• Automation & AI mindset — we use AI and automation to eliminate manual work, reduce errors, and move faster
• Strong team — we value ownership, direct feedback, respect for expertise, and collaboration toward shared goals
• Flexible compensation — payments in EUR, USD, RUB, or USDT.