Инфраструктура и безопасность вакансии

🕹 Список обязанностей: поддерживать и развивать инфраструктуру продукта на Linux; обеспечивать стабильную работу серверов, прокси и CDN;

Задачи: — сопровождать и развивать ИТ-инфраструктуру компании — администрировать серверную и сетевую инфраструктуру — поддерживать Windows Server, Hyper-V, Exchange и сервисы 1С — обеспечивать резервное копирование, мониторинг и отказоустойчивость — участвовать во внедрении решений по информационной безопасности — диагностировать и устранять инфраструктурные инциденты — участвовать в модернизации и развитии инфраструктуры Требования: — опыт системного администрирования от 5 лет — Windows Server, Hyper-V, сетевое администрирование — понимание ИБ, резервного копирования и отказоустойчивости — опыт работы с инфраструктурными инцидентами — самостоятельность и системный подход Условия: — формат работы 5/2 — ДМС — 13-я зарплата — сильная техническая команда — участие в развитии и модернизации инфраструктуры компании

Задачи: — Прямая работа с CTO: архитектурные и операционные задачи инфраструктуры — Поддержка и развитие кластеров Kubernetes: ArgoCD, Helm, GitLab CI/CD — Код на Go: внутренние утилиты и CLI, экспортеры метрик, операторы и хелперы для платформы, правки в сервисах монорепозитория — Инфраструктура как код — OpenTofu, Ansible — Сетевой контур: маршрутизация, VPN, DNS, TLS, ingress, firewall, сегментация — Docker / docker compose — локальные и staging-окружения разработчиков — Первая линия реакции на инциденты: разбор алертов, эскалация, постмортемы — Базовое администрирование сервисов — доступы, почта, админки Требования: — Kubernetes в проде — не «поднял minikube», а дежурил и чинил — GitLab CI/CD, ArgoCD, понимание GitOps-подхода — Сети — TCP/IP, DNS, NAT, VPN, TLS; умение читать tcpdump и не паниковать — Docker, docker compose — Ansible, OpenTofu (или Terraform) — Linux на уровне уверенного администрирования — Grafana и алертинг — дашборды, метрики и логи, настройка правил алертов, работа с Prometheus / Loki / Alloy — Сбор метрик с сервисов в Kubernetes — экспортеры и sidecar'ы, ServiceMonitor / scrape-конфиги, обвязка приложений метриками, RED/USE-подход к дашбордам — Kafka и NATS — не только «настроить», но и понимать семантику доставки, консьюмер-группы, отставание — Опыт highload и финтеха — платёжные интеграции, деньги, требования к надёжности — Готовность подключаться к инцидентам вне стандартных часов — Английский — документация и переписка Будет плюсом: — Go — умение писать и поддерживать код, а не только читать: утилиты, экспортеры, правки в сервисах — Опыт в iGaming

• Общаться с Shopify merchants через live chat, email и calls. • Помогать клиентам настраивать приложения и решать технические вопросы.

Проектировать архитектуру ASOC платформы - собирать, приоритезировать данные со сканеров SAST, DAST, SCA, secret detection. Разрабатывать и развивать модули платформы - от интеграции со сканерами до логики автоматического триажа.

Описание вакансии Ищем начинающего DevOps-инженера с перспективой профессионального роста внутри команды. Задачи: поддержка Linux-серверов и CI/CD, работа с Docker и GitLab Runner, автоматизация инфраструктуры с помощью Ansible, настройка мониторинга, сетей и внутренних сервисов.

Ищем человека, который сам ведёт внутренний IT и инфраструктуру: доступы, технику, хостинг-провайдеров и оплаты.

На этой позиции вы будете отвечать за администрирование облачных платформ, автоматизацию CI/CD, Infrastructure as Code, контейнеризированные среды. Важной частью роли станет обеспечение стабильной и эффективной инфраструктуры для BI-сервисов, data-driven приложений и сопутствующих систем.

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com's Product Security team protects our web and mobile applications, infrastructure, and external perimeter in a highly regulated environment. As Senior/Staff Application Security Engineer, you will raise the bar for application security across the organisation. This role is measured by leverage: how well you design, automate, and scale security processes so that many engineering teams can build securely by default. You will lead security architecture reviews and threat modelling, increasingly with the help of AI tooling, and turn one-off security work into repeatable, self-service capabilities. The role combines deep hands-on offensive and defensive security expertise with the engineering mindset needed to automate at scale. You will work closely with development, QA, DevOps, and platform teams. Responsibilities: Security Architecture & Threat Modelling: Lead security architecture reviews and threat modelling for new and existing systems, using AI tools to make reviews faster, more consistent, and scalable across teams Act as a security force multiplier by influencing the standards, patterns, and guardrails that let teams move fast and stay secure Security Automation & Tooling: Design, build, and automate scalable security processes that engineering teams can self-serve, covering secure design review, threat modelling, testing, and remediation workflows Integrate and automate security checks across the SDLC and CI/CD pipelines (SAST, DAST, SCA, secrets, and IaC scanning), tuned for strong signal and low friction Own and evolve security tooling such as DefectDojo and SAST, DAST, and SCA platforms, maximising automation, coverage, and integration Apply AI and LLM-based tooling to architecture review, threat modelling, code review, and vulnerability triage, and help define how the team adopts these tools safely Security Testing & Vulnerability Management: Conduct and oversee security assessments of web and mobile applications, APIs, and cloud infrastructure, including manual testing and PoC development Run vulnerability scans across internal infrastructure and the external perimeter, then analyse findings, define remediation, and track issues to closure Support and triage the Bug Bounty Program and external vulnerability reports, automating triage where possible Participate in and help lead red teaming and offensive security exercises Enablement: Drive knowledge sharing on secure development, mentor engineers, and deliver training for development and QA teams Requirements: Experience: 5+ years in application or product security, or equivalent depth, with a track record of senior or staff-level impact Demonstrable experience leading security architecture reviews and threat modelling (e.g. STRIDE, attack trees, data-flow analysis) across multiple teams or products Proven ability to automate and scale security processes by building tooling, integrations, and self-service workflows that reduce manual effort Technical: Strong hands-on security testing skills, including code review and web, mobile, and API application security assessments, as well as the ability to triage and validate external vulnerability reports and bug bounty submissions Strong software engineering ability in at least one language (e.g. Python, Go, JavaScript), with the ability to build automation, not just scripts Deep understanding of the OWASP Top Ten, secure design, and secure coding best practices Experience with SAST, DAST, SCA, and vulnerability management platforms, and integrating them into CI/CD Strong understanding of modern application architectures: REST APIs, microservices, cloud-based systems, and containers Practical experience applying AI and LLM tooling to security work, or clear enthusiasm and aptitude to do so Collaboration: Excellent communication and influencing skills: you can explain security concepts to technical and non-technical stakeholders and drive change without direct authority A self-starter who enjoys solving complex problems, building leverage through automation, mentoring others, and strengthening security culture Nice to have: Experience securing the AI harness: hardening LLM and agent pipelines, prompts, tool and MCP integrations, and model endpoints against prompt injection, data leakage, and insecure agent actions Experience securing Kubernetes, including cluster hardening, RBAC, network policies, admission control, workload isolation, and image and supply-chain security Experience securing AWS infrastructure, including IAM, network and account architecture, key and secret management, and CSPM Experience building AI-assisted security tooling or internal self-service security platforms Experience mentoring or technically leading a security team Offensive or advanced security certifications such as OSAI, OSEP, OSCP, or OSWE What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

Location: Warsaw, Mazowieckie, Poland; Sofia City, Bulgaria; Limassol, Cyprus Workplace: hybrid Capital.com builds and operates web and mobile trading platforms, public and partner APIs, and the backend services behind them, all in a highly regulated environment. As Application Security Architect, you will be the senior design authority for the security of these products. You will set the direction for how we secure software at scale: you will own secure-by-design patterns and standards, lead threat modelling and architecture reviews, and define the application security baseline that engineering teams build against. Working closely with the Product Security team and the Director of Product Security, you will guide AppSec processes and set the vision for your area without direct line management. You will treat security as a shared outcome rather than a gate, balancing strong protection with developer experience and delivery speed, and you will earn adoption through enablement rather than mandates. Responsibilities: Security Architecture & Standards: Define and maintain secure-by-default reference architectures for common patterns: web apps, mobile backends, microservices, public and partner APIs, and event-driven services Own core application security architecture decisions: authentication and authorisation, session management, API security, secrets management, multi-tenant isolation, and security logging and auditing Lead the redesign of user authentication and the delivery of security features into the product Develop and roll out application security standards, secure-coding guidelines, configuration standards, reusable design patterns, and architecture decision records (ADRs) that engineers can apply without a security expert in the room Define internal policies for the safe use of AI-assisted and vibe-coding tools Define security requirements for acquired technology and guide its secure integration Threat Modelling & Design Review: Establish and run a threat-modelling operating model, covering scope, cadence, templates, and facilitation, proportionate to each product's risk tier Own the security review stage of the new product approval process, covering architecture design and configuration Lead design reviews for high-impact initiatives: new products, new auth flows, payment and sensitive-data flows, platform migrations, and major refactors Identify design-level risks and agree practical, prioritised mitigations with engineering teams Secure SDLC, DevSecOps & Supply Chain: Assess the current state of application security, propose improvements, and drive the secure SDLC strategy with Engineering and Security leadership Oversee AppSec processes and own the tooling strategy (SAST, DAST, IAST, SCA, and secrets scanning), including how findings flow back to engineering Embed security controls as guardrails in CI/CD through policy-as-code, with agreed enforcement and escalation paths Partner with DevOps to organise repository management and prevent supply-chain attacks, covering safe component usage, dependency management, SBOMs, and build integrity Improve the security of our internal tools Requirements: Experience: 8+ years in technology, including 5+ years in a dedicated application or product security role, with a strong engineering background and hands-on architecture or design ownership Proven track record creating, documenting, and rolling out security standards, patterns, and best practices across a complex engineering organisation Deep, demonstrable threat-modelling experience across product portfolios Technical: Experience designing and implementing a secure SDLC in a cloud-native environment. Strong AWS knowledge is required, and exposure to GCP or other clouds is welcome Strong command of OWASP standards (Top 10, ASVS) and DevSecOps practice, including AppSec tooling (SAST, DAST, IAST, SCA, secrets scanning) and vulnerability management Deep understanding of modern distributed architectures: microservices, REST and GraphQL APIs, event-driven systems, OAuth2/OIDC, and containerised workloads (Docker, Kubernetes). You should be able to reason about their trust boundaries, attack surface, and data flows across web and mobile clients Collaboration: Exceptional ability to influence and align engineering teams without direct authority, and to brief both engineers and executives Pragmatism and strategic thinking: you balance the ideal with the achievable, protect delivery throughput, and turn long-term direction into an actionable plan Clear written communication through diagrams, ADRs, and patterns, plus a track record of mentoring and cross-functional collaboration Nice to have: Experience in fintech, trading, brokerage, or another regulated environment Awareness of relevant regulatory and compliance drivers: FCA and CySEC operational resilience, GDPR, and PCI DSS Software supply-chain security, including SBOMs and artifact and build integrity Experience securing AI-integrated product features, or using AI to scale an AppSec programme Experience building or running a Security Champions programme CSSLP, GIAC GDSA, or a hands-on offensive security certification. Certifications are valued but secondary to demonstrated experience What you'll get in return: You will join the company, that cares about work and life balance Annual Bonus based on the performance review cycle Generous Annual Leave Policy Medical Insurance and Pension fund, with additional benefit packages based on the location Hybrid working model (3 days from our modern office and 2 days fully remotely) Comprehensive Workation Policy with 30 more remote days available. Possibility of taking two additional days of paid leave per year to dedicate to volunteering efforts.

Russian required Experience with APIs: authentication flows, building requests (Postman/curl), reading technical documentation Experience with Jira and Confluence;

– Участие в развитии и эксплуатации Developer Platform на базе Kubernetes: развертывание, масштабирование, оптимизация кластеров, включая настройку сетевых политик и безопасности с помощью Cilium; – Настройка и поддержка CI/CD-пайплайнов с использованием GitLab CI, автоматизация процессов сборки, тестирования и деплоя приложений;

Ищем Asterisk / VoIP Engineer с опытом от 2 лет. Если уверенно работаете с телефонией, SIP и Linux-инфраструктурой — здесь готовы платить за реальную экспертизу.

Необходимо будет тестировать программное обеспечение, связанное с информационной безопасностью. • настраивать сетевые протоколы, VPN, маршрутизацию, SSH, DNS и Docker.

организацией приема и передачи смены, распределение задач между дежурными инженерами; контролем своевременного выполнения заявок и соблюдения SLA в течение смены;

— Следить за работоспособностью серверов, корпоративных сервисов и IT-инфраструктуры. — Быстро замечать сбои, проводить первичную диагностику и самостоятельно решать типовые технические проблемы.

— Развитие и эксплуатация Kubernetes-инфраструктуры; — Построение и развитие CI/CD-процессов;