Application & AI Security Engineer

Responsibilities:

- Run security reviews of services, integrations and public APIs before they go to production, including manual review of critical code.

- Do threat modeling for new features with product teams at the design stage.

- Own security checks in the development lifecycle (static analysis, dependency scanning, secret detection), covering coverage, rules and triage of findings with teams.

- Build a unified vulnerability management process, including the vulnerability register, prioritization, SLAs, retesting and bug bounty.

- Secure AI integrations and define access policies for service and AI agent accounts.

- Run penetration tests and audits: scope them, accept the results and follow findings through to systemic fixes.

- Develop and maintain standards and practices for developers, including secure development requirements, guidelines and team training.

Requirements:

- 3+ years of experience in application security, covering code and architecture reviews, SAST, DAST, SCA and OWASP.

- Strong manual testing skills and hands-on experience with static analysis, including writing your own custom rules.

- A solid understanding of how authorization works in practice: OAuth, OIDC, JWT, token scopes and delegated permissions.

- Ability to read PHP, Go and JavaScript code and to automate tasks in Python or Bash.

- Ability to drive results with teams you don’t manage directly, including through security champions.

- Interest in LLM application security, such as prompt injection and AI agents’ access to data.

- Working proficiency in Russian and English.

What you should know

- Manual testing with Burp Suite or ZAP

- Static analysis

- Dependency scanning

- Secret detection in code

- Vulnerability management

- OWASP Top 10

- OWASP API Security Top 10

- OWASP Top 10 for LLM Applications

- ASVS

Our stack:

- Languages: PHP (Symfony), Go, JavaScript/TypeScript, Python

- Data: PostgreSQL, MySQL, ClickHouse

- CI/CD: Docker, GitLab/GitHub, TeamCity

- Security: SonarQube, Nessus

- OS: Linux

Nice to have:

- Experience in AdTech or other high-load environments

- DevSecOps experience

- Experience testing LLM applications

- Bug bounty or CTF experience

- OSWE or GWEB certification

We offer freedom of choice:  with us, you'd have a cafeteria benefits system where you can  choose which benefits would fit your individual needs.
And, of course, a standard pack of benefits as well:  health insurance, fully covered 10 working days of sick leave per year, 5 additional day-offs per year, English and other languages compensation,   quarterly , and annual bonuses, corporate events, gifts, gym at the office, also food (yummy!) - you can find snacks in our worldwide working spaces and breakfasts & lunches in the offices!

Please note, that by applying to this position, you confirm your consent to the processing of your personal data for recruitment purposes