Описание

Be a technical leader for the AppSec engineering team.
Assist the team in making architectural and technical decisions in the field of Application Security.
Mentor engineers, helping them develop expertise in AppSec, DevSecOps, security code review, and automation.
Review technical solutions, vulnerability analysis approaches, SAST rules, and security automations.
Participate in team work planning together with the Product Owner.
Assist in prioritizing tasks considering technical risks, business context, and team workload.
Be a single point of contact for the product PO on AppSec issues: statuses, blockers, risks, roadmap, technical limitations, and team needs.
Develop the integration of security checks into CI/CD.
Develop and maintain rules for SAST tools.
Improve processes for working with SAST/SCA/DAST/MAST: quality of checks, triage, reporting, reduction of false positives.
Write automation for integrating scanners, processing results, enriching findings, and generating metrics.
Research and test new application security verification tools.
Help make security checks more useful for developers and less noisy for teams.

Experience in Application Security of 4+ years or comparable development experience with a subsequent transition to security.
Practical experience in technical leadership, mentoring, or coordinating the work of AppSec/security engineers.
Deep understanding of secure SDLC, shift-left security, and DevSecOps.
Practical experience with SAST, SCA, DAST, and/or MAST tools.
Experience integrating security checks into CI/CD.
Experience with security code review in one or more languages: Java/Kotlin, Go, Python.
Confident command of one of the languages: Python/Java/Go.
Experience working with Bash.
Deep understanding of OWASP Top 10, OWASP ASVS, and OWASP Mobile Top 10.
Understanding of modern architectures: microservices, REST/gRPC API, Kubernetes, containerization.
Experience analyzing scanning results, validating vulnerabilities, finding false positives, and prioritizing risks.
Practical experience interacting with developers on vulnerability fixes.
Understanding of mobile application security specifics.
Experience working with MAST tools.
Understanding of typical mobile application risks: insecure storage, insecure communication, improper handling of secrets, jailbreak/root detection, reverse engineering risks, certificate pinning, tampering.
Experience analyzing Android/iOS applications will be an advantage.
Instrumental use of AI for analysis, generation, and automation.

AppSec Technical Lead