Automate finding collection, duplicate handling, ticket creation and status updates. Ensure validated High pipeline and secrets findings have an owner, action and due date; follow up and escalate unresolved ownership or blockers
Work with AppSec and developers to validate findings, improve remediation guidance and check fixes where needed. Turn recurring problems into reusable checks and workflow improvements
Apply scanner configuration changes within the approved baseline. Recommend new gates, tool changes and exception-handling improvements for approval; escalate pipeline-breaking issues or critical unowned findings to Manager (DevSecOps & Application Security)
Maintain clear coverage records, troubleshooting guides and operational runbooks. Use pipeline and tool data to show missing checks, control failures and outstanding findings, and share knowledge so others can support the integrations
Requirements
At least 3+ years of hands-on experience in DevSecOps engineering roles
Strong understanding of Git workflows and CI/CD pipelines, with the ability to design reusable integrations, investigate failed jobs and assess the impact of changes on software delivery
Practical experience configuring static application security testing (SAST), software composition analysis (SCA) and secrets scanning, tuning rules, investigating false positives and routing results to the right teams
Ability to write, test and maintain automation in a suitable language, such as Python, Bash or Go, and integrate systems through APIs. A specific language is less important than reliable, maintainable integrations
Experience implementing security checks or policies as code, with version control, testing and controlled changes
Practical experience securing and hardening cloud environments with at least one major cloud provider (AWS preferred), including automated compliance checks against agreed security requirements
Working knowledge of Linux and container-based build environments, including permissions, credentials and logs needed to troubleshoot security tooling
Understanding of common application, dependency and exposed-secret risks; ability to distinguish a tool failure from a security finding and identify when specialist review is needed
Ability to maintain clear coverage records, operational runbooks and reporting using pipeline, scanner and work-item data
Strong problem-solving, communication, and collaboration skills, with the ability to take ownership of technical tasks and coordinate with cross-functional teams
English(В1), Russian (fluent)
Will be a plus
Direct experience with GitLab CI/CD security integrations
Experience with Terraform or Kubernetes security checks
Software supply-chain security, including software bills of materials (SBOMs), artifact signing or build provenance
Experience integrating dynamic application security testing (DAST), or using AI-assisted tools to improve security automation with appropriate review
Experience in fintech, trading, payments or other security-sensitive product environments
We offer
20 paid vacation days per year
10 paid sick leave days per year
Public holidays as per the company's approved Public holiday list
Medical budget
Opportunity to work remotely
Professional education budget
Language learning budget
Wellness budget (gym membership, sports gear and related expenses)
