security engineer

Virtuozzo provides cloud infrastructure system software for AI, including an optimized operating system, orchestration, and management for service providers, SaaS companies, and enterprises. Its solutions focus on performance, scalability, reliability, security, and reduced cost and complexity.

• Operate and improve vulnerability management by running and tuning scans, triaging findings, tracking remediation with system owners, and maintaining scan evidence;
• Monitor SIEM and EDR platforms and security logs to detect, investigate, and respond to security incidents;
• Maintain and configure EDR, SIEM, firewalls, intrusion detection and prevention systems, and MFA and SSO policies;
• Support identity and access management, including access provisioning, privileged access, and periodic access reviews;
• Contribute to ISO/IEC 27001 operations through control implementation, evidence collection, risk register input, and internal and external audit support;
• Assist with security assessments, penetration-test coordination, and remediation follow-up;
• Support application security across the software development lifecycle by integrating and operating SAST, DAST, dependency scanning, and container scanning in CI/CD pipelines;
• Triage application-security findings with R&D teams and track remediation;
• Help secure the build and release chain through source-repository access controls, secrets management, artifact signing, and pipeline hardening;
• Help maintain security policies, procedures, and standards and track exceptions;
• Track endpoint fleet security posture across Windows, macOS, and Linux, including MDM enrollment, EDR coverage, and disk encryption;
• Participate in security-awareness training and educate end users on security best practices;
• Troubleshoot security-related outages and incidents and produce root-cause or post-incident documentation;
• Work with the wider IT and Security team to build, document, and implement internal processes and workflows;
• Stay up to date with security threats, trends, and technologies.

• At least three years of experience in security engineering, security operations, or systems administration with a strong security focus;
• Working knowledge of firewalls, IDS/IPS, SIEM, EDR, and vulnerability scanners;
• Solid networking fundamentals, including TCP/IP, VLANs, routing, VPNs, and firewalling;
• Experience with identity and access management, Active Directory or Microsoft Entra ID, and SSO/MFA platforms such as Okta or similar;
• Working experience with Microsoft 365 and Exchange Online;
• Comfortable working with Windows, macOS, and Linux systems;
• Understanding of application-security fundamentals, including the OWASP Top 10, secure-coding practices, and vulnerability triage in code and dependencies;
• Understanding of security and compliance frameworks such as ISO/IEC 27001, SOC 2, or similar, including suitable audit evidence;
• Strong problem-solving skills and attention to detail;
• Ability to work collaboratively within a team;
• Strong written and verbal communication skills in English;
• Nice to have: Security certifications such as Security+, SSCP, CEH, ISO/IEC 27001 Lead Implementer, or ISO/IEC 27001 Lead Auditor; experience with Qualys, Greenbone/OpenVAS, Wazuh, Splunk, MDM tools such as Hexnode, endpoint hardening, Python, Bash, PowerShell, SonarQube, Semgrep, Snyk, OWASP ZAP, Trivy, Bitbucket Pipelines, Jenkins, secure-SDLC practices, threat modelling, security code reviews, secrets scanning, cloud and virtualization platforms, ISO/IEC 27001 certification programs, or customer security audits.

• Contract employment;
• Open to candidates in Serbia, Bulgaria, Georgia, and Armenia;
• Share options;
• Referral bonuses;
• Certifications and learning opportunities aligned with interest and role requirements;
• Other perks and engagement opportunities.