Кибербезопасность вакансии - в офисе

Location: Baku Workplace: onsite ABOUT YOU We are looking for a junior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will work closely with senior specialists to identify, assess, and help remediate security vulnerabilities across our products and infrastructure. You will be involved in day-to-day AppSec work - code reviews, vulnerability triage, threat modeling, and security testing. You are curious, detail-oriented, and eager to develop deep expertise in application security. You do not need to have all the answers, but you ask the right questions and follow through. This is a strong learning environment. You will be exposed to real-world security challenges in a payment platform operating at scale, and supported by experienced security specialists who will help you grow.   ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Triage Security Findings - Assess incoming bug bounty reports and scanner findings. Evaluate validity, calculate real severity, and escalate appropriately with clear written summaries. Assist with Vulnerability Assessments - Participate in security assessments of web applications and APIs. Help identify and document risks in new features and existing systems. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way that engineering teams can act on. Support Threat Modeling - Participate in threat modeling sessions. Learn to identify trust boundaries, data flows, and attack surfaces in system designs. Monitor Security Tools - Help operate SAST , DAST , and dependency scanning tooling. Track findings, reduce noise, and support remediation workflows. Support Code Reviews - Review code for common vulnerability classes under guidance of senior specialists. Learn to identify security issues across PHP, Python, and Go codebases. Stay Current - Follow developments in the security community. Bring awareness of new vulnerability classes, CVEs, and attack techniques relevant to our stack. What You Bring Web Security Fundamentals - Solid understanding of common vulnerability classes: OWASP Top 10, CSRF , XSS , IDOR , SQL injection, open redirect, authentication and session management weaknesses. You understand root causes, not just names. Web and Browser Fundamentals - Solid understanding of how web applications work: HTTP request/response cycle, client-server model, REST APIs, how browsers handle same-origin policy, cookies and their attributes, and CORS . This is the foundation everything else builds on. Security Testing Tools - Hands-on experience with Burp Suite or similar web application security testing tools. You have used them to intercept, modify, and replay requests — not just run automated scans. Vulnerability Documentation - Able to reproduce a vulnerability and write it up clearly: reproduction steps, proof of concept, and impact statement. Findings that engineering teams cannot reproduce or understand do not get fixed. Secure Development Awareness - Familiarity with foundational secure coding concepts: input validation, output encoding, parameterized queries, and least privilege. Code Readability - Ability to read and follow code in at least one language relevant to web security - PHP, Python, JavaScript, or Go. You don't need to be a developer, but you need to follow logic and spot security-relevant patterns. Analytical Thinking - You reason through problems methodically. You can explain not just what a vulnerability is but why it exists, how it is exploited, and what fixing it actually requires. Clear Written Communication - You write findings and summaries that are precise, reproducible, and useful to the engineers who need to act on them. Curiosity and Initiative - You dig into problems rather than stopping at the surface. When something looks wrong, you investigate before concluding Nice to Have Participation in bug bounty programs or CTF competitions; Basic scripting ability for automation - Python or Bash; Familiarity with CI/CD pipelines and where security tooling fits; Exposure to cloud environments - GCP, AWS, or Azure; Relevant coursework or certifications - eWPT, CEH , PortSwigger Web Security Academy progress, or similar entry-level credentials. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: Baku Workplace: onsite ABOUT YOU We are looking for a senior application security specialist to join a growing security team at Xsolla. This is a hands-on role where you will own security initiatives end-to-end - identifying, assessing, and driving remediation of security vulnerabilities across our products and infrastructure. You will lead day-to-day AppSec work - deep code reviews, vulnerability triage, threat modeling, and security testing - and set the standards for how this work is done. You are rigorous, pragmatic, and able to balance security risk against business velocity in a payment platform operating at scale. You will also mentor junior specialists and help raise the security bar across engineering teams. ABOUT US   Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game. For more information, visit xsolla.com. Responsibilities Own Vulnerability Management - Lead triage of bug bounty reports and scanner findings. Set severity standards, drive escalation policy, and ensure remediation SLAs are met across teams. Lead Security Assessments - Plan and conduct in-depth security assessments and penetration tests of web applications, APIs, and services. Define assessment scope and methodology. Drive Threat Modeling - Facilitate threat modeling sessions with engineering teams. Identify trust boundaries, data flows, and attack surfaces early in the design phase, and embed the practice into the SDLC . Own AppSec Tooling Strategy - Select, operate, and tune SAST , DAST , SCA , and secrets-scanning tooling. Design noise-reduction and auto-triage workflows; integrate security gates into CI/CD. Lead Secure Code Reviews - Perform security-focused code reviews across PHP, Python, and Go codebases. Define secure coding guidelines and review checklists for engineering teams. Mentor and Educate - Coach junior security specialists, run internal security training, and champion security awareness among developers. Write Clear Security Documentation - Document findings, reproduction steps, and remediation guidance in a way engineering teams can act on. Set the documentation standard for the team. What You Bring 4+ years in application security or a closely related security engineering role, with demonstrable ownership of AppSec programs or major initiatives. Deep Web Security Expertise - Expert-level understanding of vulnerability classes ( OWASP Top 10 and well beyond: SSRF , deserialization, request smuggling, OAuth/ OIDC flaws, business logic abuse). You understand root causes, exploitation chains, and realistic impact in production systems. Offensive Testing Proficiency - Extensive hands-on experience with Burp Suite and manual testing methodology. You can find vulnerabilities that scanners miss and chain low-severity issues into meaningful impact. Code Fluency - Comfortable reading and auditing code in at least one of: PHP, Python, Go, JavaScript. Able to trace data flows across services and spot vulnerable patterns without runtime access. Secure SDLC Experience - Practical experience embedding security into development workflows: security requirements, design review, CI/CD security gates, and developer enablement. Risk Communication - You can calculate and defend real severity, push back on inflated findings, and explain risk to both engineers and leadership in their own language. Analytical Thinking - You reason through problems methodically and can explain not just what a vulnerability is, but why it exists, how it is exploited, and what fixing it actually requires. Ownership and Follow-Through - You drive findings to resolution across team boundaries without being asked. Nice to Have Track record in bug bounty programs (accepted reports on major platforms) or notable CTF results; Strong automation skills - Python or Go for building internal security tooling; Experience securing cloud-native environments - GCP preferred; Kubernetes security a plus; Advanced certifications - OSWE , OSCP , BSCP , or GWAPT; Experience in payments, fintech, or other regulated environments ( PCI DSS familiarity); CVE credits, public security research, or conference talks. Xsolla operates across multiple time zones. Strong written communication is essential - you will need to document your work clearly so findings and context are not lost across handoffs. We value directness, intellectual honesty, and follow-through. If you do not know something, say so and find out. If you find something, explain it clearly and see it through to resolution.

Location: New York; Stockholm Workplace: OnSite ABOUT US: AI NEEDS A NEW INFRASTRUCTURE LAYER. WE'RE BUILDING IT AT MODAL. Every era of computing brought new workloads that previous infrastructure couldn't support: mainframes, databases, and the cloud. Each time, the company that rebuilt the layer underneath defined the decade. AI is no different, except it touches everything instead of one slice, and the window to build the layer underneath it is open right now. Our customers include category-defining companies like Ramp https://modal.com/blog/how-ramp-built-a-full-context-background-coding-agent-on-modal, Cognition, DoorDash, and Suno. They rely on Modal for instant GPU access, sub-second container starts, and native storage, so it's simple to serve low-latency inference, fine-tune models, and access production-ready sandboxes at scale. We've passed $1B in annualized run rate, up 15x from a year ago. In October 2026 we raised a $750M Series D led by Accel at a $15.75B valuation. Our team includes creators of popular open-source projects (e.g.,Seaborn https://github.com/mwaskom/seaborn,Luigi https://github.com/spotify/luigi), academic researchers, international olympiad medalists, and experienced engineering and product leaders with decades of experience. THE ROLE: We’re looking for an Infrastructure Security Engineer to design and secure the core systems that power our platform. This role focuses on building security directly into our infrastructure: from container isolation and orchestration to identity and secrets management in a multi-tenant, cloud-native environment. You’ll work closely with engineering teams to define secure primitives and ensure our platform is resilient, scalable, and trustworthy by design. This is a hands-on, deeply technical role focused on real systems, not compliance or policy. WHAT YOU’LL WORK ON: Platform & Runtime Security - Design and improve isolation mechanisms for multi-tenant workloads (containers, sandboxing, execution environments) - Strengthen boundaries between customers, workloads, and internal systems - Identify and mitigate risks in distributed, dynamic compute environments Container & Orchestration Security - Secure and harden containerized workloads and orchestration systems (e.g., Kubernetes or similar) - Improve workload isolation, scheduling boundaries, and runtime protections - Evaluate tradeoffs in multi-tenant execution models Identity & Access Management - Design and improve authentication and authorization systems across services - Implement strong service-to-service identity and least-privilege access patterns - Improve access controls across infrastructure and internal systems Secrets & Key Management - Build and maintain systems for securely managing secrets, tokens, and credentials - Improve rotation, auditing, and access controls - Reduce secret sprawl and integrate secure patterns into developer workflows Cloud & Infrastructure Security - Secure cloud environments across providers (AWS, GCP, etc.) with a focus on consistency and portability - Improve network boundaries, service segmentation, and access controls - Embed security into infrastructure-as-code and deployment systems Engineering Partnership - Work closely with product and infrastructure teams to design secure systems from the ground up - Review architecture and code for security risks and provide actionable guidance - Identify patterns in risks and drive cross-cutting improvements YOU MAY BE A FIT IF: Core Experience - You have experience securing cloud-native infrastructure and distributed systems in production - You have a background in infrastructure, backend, or security engineering - You’ve worked in multi-tenant or high-scale environments Technical Depth - You have a strong understanding of containerization and orchestration systems (e.g., Kubernetes or similar) - You’ve designed or secured isolation mechanisms in multi-tenant systems - You have a solid understanding of authentication, authorization, and service identity models - You have experience with secrets management and secure handling of credentials - You have a strong foundation in networking concepts (segmentation, service communication, access boundaries) Mindset - You have a builder mentality: you design and implement, not just review - You take a pragmatic approach to security in fast-moving environments - You’re comfortable working deeply with engineers and influencing system design NICE-TO-HAVE: - Experience with sandboxing or runtime isolation technologies (e.g., gVisor, Firecracker, seccomp, or similar) - Familiarity with kernel-level or low-level isolation primitives - Experience securing Kubernetes or similar orchestration systems in production - Background in developer infrastructure, compute platforms, or multi-tenant systems

О ПРОЕКТЕ StarTribe — часть крупного международного холдинга с 10-летней историей. Мы разрабатываем высоконагруженные IT-продукты для мировых брендов. Сейчас мы усиливаем команду безопасности для тестирования внутренних и публичных приложений собственной разработки. ВАШИ КЛЮЧЕВЫЕ ЗАДАЧИ — Pentesting: Проведение глубоких тестов веб-приложений (White/Grey/Black box). — Remediation: Подготовка конкретных рекомендаций по устранению уязвимостей. — Collaboration: Тесное взаимодействие с разработчиками для внедрения Security Best Practices. — DevSecOps: Участие в разработке внутреннего инструментария и автоматизации проверок. — Mentoring: Помощь коллегам и развитие экспертизы внутри команды. ЧТО МЫ ЖДЕМ ОТ ВАС — Опыт: 4+ года в области AppSec и тестирования безопасности веб-приложений. — Инструментарий: Экспертное владение Burp Suite и другими средствами анализа (Manual & Auto). — Коммуникация: Умение аргументированно доносить риски до бизнеса и находить компромиссы с Dev-командами. — Стек: Понимание специфики безопасности Node.js и PHP (дополнительно .NET / Go). БУДЕТ ПЛЮСОМ — Сертификации уровня OSCP, OSWE или Burp Suite Certified Practitioner. — Активное участие в CTF, наличие рейтинга на HackTheBox. — Наличие подтвержденных Bug Bounty репортов. УСЛОВИЯ И БЕНЕФИТЫ — Оформление: Официальный контракт по ТК Кипра. — Релокация: Частичная компенсация аренды жилья и корпоративная мобильная связь. — Бонусы: Годовой бонус по результатам, 4 дополнительных Day Off в году. — Life Quality: Корпоративное питание, спорт, мероприятия для семей и активности для детей. — Развитие: Скидка 50% на SkyEng, поддержка образовательных инициатив.

Location: Athens; Thessaloniki Workplace: onsite The Role:    As a Junior Systems Monitoring Officer working within our team, you will be responsible for managing a variety of risks for the company, relating to our systems and the various products we offer to our clients and partners. Using in-house tools and reports, you will monitor and evaluate client behaviour, analyse and evaluate the products we offer, and take initiative to help improve on the current tools, reports and procedures used and followed by the department. The main responsibilities of the position include: Monitor the system used by the department and analyse various reports Conduct reviews and investigations of client activity Monitor and ensure swift actions are being taken to manage a range of risks Identify, examine, and report any suspicious activities related to the violation of the Terms and Conditions or the company Work with other departments to perform daily duties and to achieve common goals Stay up to date with market and economic developments Main requirements: BSc/MSc in Mathematics, Statistics, Economics, or any other relevant field (first or upper second-class honours) Strong analytical skills Organised and methodical personality, high attention to detail Excellent oral and written communication skills in English Excellent working knowledge of Microsoft Office tools Ability to work on a well-structured, rotating shift schedule, including weekends Benefit from: Attractive remuneration package Private health insurance Corporate pension fund Intellectually stimulating work environment Continuous personal development and international training opportunities The Hiring Experience: What Awaits You Let’s Connect – Intro Chat with Talent Acquisition Deep Dive – First Interview with Your Future Team Test your edge – Aptitude Assessment Final Connection – Final Interview All applications will be treated with strict confidentiality!   By submitting this application, I confirm that I have read and agree to the terms of the Privacy Policy and the Confidentiality Undertaking.