Вакансии

Требования: Архитектура highload-сервисов: Опыт проектирования высоконагруженных распределённых систем: горизонтальное масштабирование, отказоустойчивость, балансировка нагрузки, кэширование, очереди, rate limiting, graceful degradation.

– Опыт в кибербезопасности от 2–3 лет в одной или нескольких областях: Application Security, DevSecOps, Cloud Security, Kubernetes Security, API Security, Product Security;

Location: Intellias Meet your recruiter Sushil Francis Borde sushil.borde@intellias.com https://www.linkedin.com... Vacancy details Information Security Security Engineer Senior Bulgaria, Croatia, Egypt, India, Poland, Portugal, Spain, Ukraine, United Kingdom Remote APPLY NOW REFER A FRIEND We are looking for a Security / Policy Engineer to design and implement authorization models for AI agents and cloud-native platforms. The role focuses on AWS AgentCore Policy (Cedar), policy-as-code, OAuth/JWT-based authorization, and zero-trust security architecture. The ideal candidate has hands-on experience with cloud security, identity engineering, ABAC design, and enterprise-grade access control systems. What project we have for you Our customer is a multinational corporation with more than a century of history and offices in over 180 countries. Their most ambitious goal at the time is to introduce a range of Reduced-Risk Products (RRPs). The target audience is more than 1 billion consumers around the globe. IT platform hosts 700+ applications. Intellia’s mission is to help the client with the engineering of a comprehensive software ecosystem for a game-changing IoT product on the margin of innovative consumer experience and cutting-edge technology. Our teams are involved in the engineering of core platform components for best-in-class eCommerce, Digital Marketing and IoT solutions. As an Engineer, you will become a part of Core Architecture Team and be responsible for the architecture, implementation of best practices in our Digital Engineering Enterprise Platform. The Platform is a set of services and internet applications that accelerate the development and delivery of software applications by taking care of common SDLC challenges. The Platform provides access and consumption for engineering teams to a set of services, technologies, practices for their development and for operating their application, ensuring a set of compliance and best practices. What you will do Design and implement authorization policies using Cedar and AWS AgentCore Policy. Develop and maintain policy-as-code frameworks for cloud-native and AI-agent platforms. Build and govern Attribute-Based Access Control (ABAC) models following least-privilege and default-deny principles. Integrate authorization systems with OAuth 2.0, JWT, and Microsoft Entra ID. Define and maintain principals, resources, actions, and conditional access policies. Design token validation, claims mapping, and authorization decision workflows. Implement audit logging and traceability for policy evaluation and access decisions. Partner with security, architecture, and platform teams to support enterprise security reviews and governance processes. Contribute to zero-trust security architecture and authorization strategy across distributed systems. Evaluate and adopt emerging AWS authorization technologies, including Cedar and AWS Verified Permissions. What you need for this • AWS AgentCore Policy (Cedar) • Cedar policy language (principals, actions, resources, conditions) • OAuth 2.0 / JWT / MS Entra integration • Policy-as-code patterns • Default-deny authorization models • Audit logging for policy decisions Experience: • 5+ years cloud security or identity engineering • Attribute-based access control (ABAC) design • OAuth 2.0 / JWT token inspection and claims mapping • Enterprise security review (InfoSec, ARB processes) Will be a plus: • AWS Cedar (open source) prior exposure • AWS Verified Permissions or AgentCore Policy early experience • Zero-trust architecture design What it’s like to work at Intellias At Intellias, where technology takes center stage, people always come before processes. By creating a comfortable atmosphere in our team, we empower individuals to unlock their true potential and achieve extraordinary results. That’s why we offer a range of benefits that support your well-being and charge your professional growth. We are committed to fostering equity, diversity, and inclusion as an equal opportunity employer. All applicants will be considered for employment without discrimination based on race, color, religion, age, gender, nationality, disability, sexual orientation, gender identity or expression, veteran status, or any other characteristic protected by applicable law. We welcome and celebrate the uniqueness of every individual. Join Intellias for a career where your perspectives and contributions are vital to our shared success.

- Разработка серверной части государственных информационных систем в сфере здравоохранения; - Уверенное владение Java, понимание ООП, коллекций, обработки исключений и основ многопоточности;

-Проектирование, разработка и поддержка backend-сервисов на NestJS и TypeScript. -Разработка и развитие микросервисной архитектуры, обеспечение отказоустойчивости и масштабируемости.

Разрабатывать и поддерживать production‑backend для финансовых сервисов, обеспечивать стабильность и отказоустойчивость при реальной нагрузке и сбоях; Реализовывать ключевые сценарии: верификация личности, операции с картами, переводы, кредиты, депозиты, обмен валют;

OpenRouter is looking for a Software Engineer Identity Platform to build and own authentication, authorization, enterprise identity, and secure credential systems.

🟠Turn business needs into system requirements, user stories and acceptance criteria. 🟠2.5+ years as a Business Analyst, System Analyst, Product Owner or Product Manager.

Location: Baku Workplace: onsite ABOUT YOU You will play a pivotal role in delivering high-impact software solutions across our platform. You bring curiosity, initiative, and a passion for clean, scalable systems. You collaborate effectively with teammates and cross-functional partners to design, build, and improve our technical stack. You’re hands-on, deeply engaged in the code, and consistently seeking better ways to solve complex engineering challenges.   ABOUT US Xsolla is a global commerce company with robust tools and services to help developers solve the inherent challenges of the video game industry. From indie to AAA, companies partner with Xsolla to help them fund, distribute, market, and monetize their games. Grounded in the belief in the future of video games, Xsolla is resolute in the mission to bring opportunities together, and continually make new resources available to creators. Headquartered and incorporated in Los Angeles, California, Xsolla operates as the merchant of record and has helped over 1,500+ game developers to reach more players and grow their businesses around the world. With more paths to profits and ways to win, developers have all the things needed to enjoy the game.   For more information, visit xsolla.com. WHAT YOU'LL DO Software Engineering & Problem Solving: Build and ship reliable, secure, and scalable backend systems. Own implementation from design to deployment, ensuring maintainability and performance. Participate in architectural discussions and offer informed technical input. Refactor legacy codebases to improve structure and efficiency while maintaining feature continuity. Drive production readiness by handling incident response, root cause analysis, and observability improvements. Technical Excellence: Write clear, testable, and well-documented code, emphasizing quality and automation. Contribute to a culture of engineering excellence through code reviews and design discussions. Advocate for sound software development practices and continuous improvement. Collaboration & Impact: Work closely with product managers, designers, and other engineers to align on objectives and deliverables. Contribute to technical scoping and estimation for features and infrastructure work. Identify opportunities to reduce technical debt and improve the developer experience. QUALIFICATIONS Hands-on experience with Go (Golang ) in production environments. Strong experience working with PostgreSQL and/or MySQL. Proficient with containerization and orchestration tools: Docker, Kubernetes (K8s), and Helm. Familiarity with messaging systems like RabbitMQ or Kafka. Comfortable using Git and CI/CD tooling in collaborative workflows. Working knowledge of frontend technologies, especially React and/or Next.js . Basic understanding of cloud platforms (GCP preferred). WHAT SETS YOU ARART Experience building scalable, secure Login-as-a-Service platforms. Deep knowledge of OAuth2, OIDC, SAML, JWT, and session/token management. Strong grasp of social login, SSO, and federated identity. Designed multi-tenant identity systems with isolation and configurability. Delivered developer-friendly APIs, SDKs, and integration documentation. Strong English communicator, for both technical and non-technical topics. The duties and responsibilities of this position may evolve over time to support the organization’s goals and individual growth. This job description is intended to outline the general nature and level of work being performed and is not intended to be an exhaustive list of all duties, responsibilities, and qualifications required. By submitting your application, you consent to Xsolla conducting background checks, where permitted by law, after the final interview stage. All checks will comply with local regulations, and your information will be handled confidentially. Xsolla takes your privacy seriously and will not sell or externally distribute any personal data received during the hiring process. In accordance with applicable data protection laws, Xsolla is committed to protecting your personal information and respecting your privacy. For any inquiries related to data privacy, please contact: careers@xsolla.com Explore more opportunities at: https://xsolla.com/careers

Location: Москва Команда БТР развивает ГигаНетворк — платформу для автономных B2B-сделок между ИИ-агентами. Мы строим инфраструктуру, где агенты-закупщики и агенты-поставщики ведут переговоры, заключают договоры, подписывают документы и проводят платежи. Продукт готовим к демонстрации на AI Journey 2026 и к промышленному пилоту на 100+ клиентов. Обязанности * разработка бэкенд-сервисов харнеса ГигаАгента (оркестрация навыков, управление сессиями, сохранение трейсов и стейта сделки) * реализация интеграционных сервисов: СберБизнес АПИ (клиент-инфо, подключение УКЭП, связки агент-счёт, лимиты), блокчейн ГигаЧейн (смарт-контракты, Discovery, датафиды), ЭП/КриптоПро, ЭДО * разработка сервисов генерации документов (дополнительные соглашения к ДБО, договоры сделок) с использованием Apache POI и шаблонных движков * реализация MCP-коннекторов для интеграции агента с внешними системами * проектирование и реализация REST/GraphQL API для фронтенда GigaCowork * обработка событий из блокчейна (ораклы ЭДО, ERP, платёжные статусы). Требования * опыт работы: от 5 лет коммерческой разработки на Python * уверенное владение Python 3.10+, опыт с FastAPI или Flask * опыт работы с асинхронным программированием * опыт проектирования и реализации микросервисной архитектуры * опыт работы с PostgreSQL (оптимизация запросов, проектирование схемы) * опыт интеграции с внешними REST API, работа с OAuth2, JWT * опыт работы с Docker, Kubernetes * понимание принципов событийно-ориентированной архитектуры (Kafka, RabbitMQ) * опыт написания модульных и интеграционных тестов * понимание принципов чистого кода, SOLID, DRY * опыт работы с Git, CI/CD. **Будет плюсом** * опыт работы с блокчейн-технологиями (смарт-контракты, транзакции, ноды) * опыт интеграции с банковскими сервисами или платёжными системами * опыт работы с электронной подписью (КриптоПро, PKI, сертификаты) * опыт работы с LLM / AI-агентами (LangChain, LlamaIndex, MCP-протокол) * опыт работы с генерацией документов (Apache POI, docx-шаблоны, bookmark) * понимание принципов ЭДО * опыт работы в финтехе или банковской сфере. Условия * гибридный формат работы * современный IT-офис вблизи Москва-Сити в пяти минутах от метро "Кутузовская", с фитнес залом * более 400 образовательных программ СберУниверситета для профессионального и карьерного развития * расширенный ДМС, льготное страхование для семьи и корпоративная пенсионная программа * гибкий дисконт по ипотечному кредиту, равный 1/3 ключевой ставки ЦБ * подписка Прайм с возможностью совместного использования на трёх близких * вознаграждение за рекомендацию друзей в команду Сбера.

Location: Москва Workplace: гибкий Мы разрабатываем крупнейший мессенджер в России, чтобы соединять людей, сервисы и компании. Наша миссия — создавать простые и удобные инструменты коммуникации. Ищем в команду опытного инженера Application Security для поддержки и развития процессов безопасной разработки. Задачи Внедрение и развитие процессов Security SDLC: интеграция проверок безопасности на всех этапах разработки — от проектирования (Security Champions, threat modeling) до запуска в продакшен Пентест и исследования: проведение ручного тестирования безопасности веб-приложений, мобильных приложений и API; участие в программах Bug Bounty Работа со статическим и динамическим анализом кода (SAST/DAST): использование автоматизированных инструментов сканирования, триаж и написание рекомендаций по устранению Код-ревью: проведение экспертного анализа исходного кода на предмет уязвимостей (OWASP Top 10, CWE) Консультирование команд: тесная работа с разработчиками, архитекторами и DevOps-инженерами. Объяснение уязвимостей, помощь в поиске лучших способов их устранения, проведение воркшопов Управление уязвимостями: классификация, приоритизация и контроль устранения найденных уязвимостей Разработка безопасных стандартов: создание и внедрение чек-листов, гайдов и лучших практик (secure coding guidelines) для разработчиков Требования Опыт работы на позиции AppSec Engineer или пентестера веб-приложений от двух лет Глубокое понимание OWASP Top 10, CWE Top 25, принципов построения веб-приложений и типовых уязвимостей Опыт работы с одним или несколькими инструментами SAST, DAST, SCA (Burp Suite, OWASP ZAP и так далее) Умение читать и понимать код на одном из языков программирования, например на Python, Go, Java, Java Script Знание основных протоколов и технологий: HTTP/HTTPS, SSL/TLS, REST API, JSON Web Tokens (JWT) Понимание принципов работы современных CI/CD-систем (GitLab CI, GitHub Actions, Jenkins) Умение понятно объяснять сложные концепции безопасности разработчикам Стремление автоматизировать рутину и постоянно учиться новому Будет плюсом Опыт проведения threat modeling Навыки в области облачной безопасности Знание контейнеризации (Docker, Kubernetes) и принципов DevSecOps Наличие публичных работ (статьи, доклады, выводы CVE) или участие в программах Bug Bounty и конференциях Соответствующие сертификации: OSCP, OSWE, GWEB, CSSLP и другие

Location: Москва Workplace: Удаленная работа О компании Наша команда выполняет работы в области наступательной кибербезопасности. Мы реализуем проекты различного уровня сложности и специфики: от классических тестов на проникновение до Red Team и Purple Team оценок. Ищем Ведущего Специалиста по информационной безопасности (Pentester), который хочет развиваться в области offensive security и работать с интересными задачами. Обязанности Проводить проекты по анализу защищённости и тестам на проникновение (внешние/внутренние, веб/мобильные приложения, Wi-Fi, социальная инженерия); Участвовать в Red Team-оценках и моделировании атак; Искать 0-day уязвимости, разрабатывать PoC и 1-day эксплойты; Исследовать инфраструктуру: доменные среды, сетевые сегменты, приложения, облачные сервисы; Проводить анализ исходного кода, искать и верифицировать уязвимости; Разрабатывать и адаптировать инструменты для автоматизации поиска и эксплуатации уязвимостей; Готовить отчёты с воспроизведением уязвимостей и рекомендациями по устранению; Участвовать в обучении, развивать внутренние методики и базу знаний команды. Требования Опыт проведения атак на внешний периметр и эксплуатации уязвимостей на уровне инфраструктуры и приложений; Глубокое понимание веб-технологий: HTTP/HTTPS, REST/GraphQL, WebSockets, CORS, механизмы сессий, авторизация (JWT, OAuth2, SSO); Опыт поиска и эксплуатации server-side уязвимостей: RCE, SQLi, SSRF, XXE, LFI/RFI, Path Traversal, Race Conditions, Insecure Deserialization, Business Logic Bugs; Уверенное чтение и анализ исходного кода на C/C++, Java, Python, PHP, JavaScript, Go; Понимание принципов работы инфраструктуры: Active Directory — структура, механизмы аутентификации, Kerberos, LDAP, привилегии и пути эскалации, Windows и Linux — внутренняя архитектура, типовые механизмы безопасности, служебные компоненты; Сетевые технологии — протоколы TCP/IP, DNS, SMB, RPC, HTTP(S), VPN, VLAN, маршрутизация и фильтрация трафика; Навыки разработки PoC/эксплойтов и инструментов (Python, Go, PowerShell, Bash); Понимание техник обхода защиты и скрытия активности при выполнении атак; Владение инструментами: Burp Suite Pro, Nmap, sqlmap, wfuzz, Metasploit, BloodHound, NetExec, Wireshark, IDA/Ghidra и др.; Знание MITRE ATT&CK и методов построения TTP-сценариев; Будет преимуществом:; Наличие сертификатов OSCP, CRTO, OSEP, eCPPT, публикации CVE/БДУ, bug bounty-репорты, собственные разработки и исследования. Условия ДМС с первого месяца работы — 100% покрытие всех медицинских расходов, включая стоматологию; Выгодные скидки и специальные предложения от партнеров на фитнес, курсы английского и другие полезные активности; Возможность участвовать во внешних конференциях и повышать квалификацию за счёт компании через внешнее обучение; Работа в команде профессионалов, готовых делиться знаниями; Открытая и дружелюбная корпоративная культура, где каждый чувствует себя частью единой команды, общается на равных и всегда на «ты». Мы ценим вклад каждого, поддерживаем инициативность и создаём комфортные условия для профессионального и личностного роста.

Проектировать понятные пользовательские сценарии для личных кабинетов и административных систем.

🔹 Work in an Agile delivery team: planning, grooming and reviews. 🔹 Turn business needs into system requirements, user stories and acceptance criteria.

• Уверенный Python, Django/DRF, PostgreSQL. • Celery и Redis в продакшене.

Location: Limassol, Cyprus Workplace: hybrid We are looking for an Application Security Engineer in the AppSec team. As a Senior Application Security Engineer at inDrive, you will own whole areas of our AppSec program, from security requirements and design reviews to controls that work in production. You will work with product, platform and infrastructure teams on new architecture, AI systems and the security of our apps and services. The role fits a hands-on engineer who reviews code and architecture, leads work across several teams and makes security decisions based on data. Key Responsibilities Own one or more areas of the AppSec program end to end, including the plan, the risks and the metrics. Run security design reviews and threat modeling of new features, services and AI systems, and defend security requirements at the architecture committee. Assess the security of web, mobile and API applications and find variants of confirmed vulnerabilities across other services. Coordinate external security assessments and bug bounty findings, from triage and prioritisation with teams to fix verification. Design secure authentication and authorization between users, services and internal tools together with platform teams. Choose, pilot and tune security tools, and keep only those that pay off in real findings. Turn incidents and assessment results into lasting controls, policies and secure defaults for developers. Consult development teams on complex security issues and take shifts in AppSec duty for Critical and High incidents. Skills, Knowledge and Expertise Higher education in IT, preferably in information security. Knowledge of mobile application security on Android and iOS, client-server trust, app integrity and protection against bots and account takeover. Deep knowledge of web and API security, including authentication and authorization flaws, SSRF, injections and business logic issues, and the ability to find variants of a vulnerability class across many services. Strong understanding of identity and access, OAuth 2.0, OIDC, JWT, signing key rotation, mTLS, service-to-service authentication and SSO. Understanding of security risks of AI systems and LLM agents, such as prompt injection, excessive tool permissions and agent access to sensitive data, and practical use of AI in your own security work. Practical understanding of cloud-native infrastructure, Kubernetes, containers, API gateways and AWS. Experience in threat modeling and security design review of new features and architecture. Understanding of vulnerability management and risk, including severity, SLA, compensating controls and risk acceptance. Ability to read and review code in at least one language, preferably Golang. Track record of leading projects with two or more teams from a requirement to a verified fix, and clear written English. Experience with secrets and key management, rotation and response to credential leaks. Nice to have Knowledge of software supply chain security, dependencies, CI/CD pipelines and source control platform hardening. Experience tuning SAST, DAST and SCA tools for precision and judging a tool by noise and cost per real finding. Why join us Help us challenge injustice by creating fair choices for millions of people across 47 countries. Develop your professional skills with access to mentoring, career consulting, and learning programs. Collaborate with teams around the world and gain international experience through our Global Talent Exchange Program. Engage in company-wide challenges, awards, sports activities, employee-led social impact and volunteering projects. Work alongside people who take initiative, speak openly, and challenge themselves to grow. Improve your language skills through co-financed courses and internal speaking clubs. Annual salary from 70 700 EUR gross. Final benefits may vary depending on the location.

Location: Albania; Azerbaijan; Georgia; Serbia; Slovenia; Poland Intetics Inc. , a global technology company providing custom software application development, distributed professional teams, software product quality assessment, and “all-things-digital” solutions, is seeking a highly skilled and experienced Go Developer to join our dynamic team on a full-time basis. We are looking for a Senior/Lead Go Backend Engineer with strong Identity and Access Management (IAM) expertise to design, build, and operate secure, high-performance authentication services. The candidate should have 7+ years of backend engineering experience, including 5+ years with Go and 3–4+ years working with authentication, authorization, SSO, MFA, OAuth 2.0, OpenID Connect, JWT, and session management in production environments. Project Responsibilities: - Design, develop, and operate high-throughput, low-latency identity services: Single Sign-On (SSO), Multi-Factor Authentication (MFA), session management, and federation. - Own features end-to-end from design through production and support. -Implement and scale modern authentication and authorization protocols and token formats (OAuth 2.0, OpenID Connect, JWTs), including secure token issuance, rotation, and revocation strategies. -Write clean, concurrent, and highly performant backend services primarily in Go; design idiomatic, testable code and clear API contracts (gRPC/HTTP). - Use your DevOps experience to deploy, manage, and automate identity infrastructure (CI/CD, monitoring, and incident response). - Serve as the subject matter expert on authentication and identity: own internal security reviews, threat modeling for identity flows, and guide other teams on secure integrations with our platform. Integrate and maintain solutions with custom and standard identity providers (e.g. Keycloak and AWS Cognito), and federation patterns. - Mentor engineers, conduct design reviews, and contribute to the team's technical roadmap and security posture. Requirements 7+ years of backend engineering experience, including 5+ years with Go and 3–4+ years working with authentication, authorization, SSO, MFA, OAuth 2.0, OpenID Connect, JWT, and session management in production environments Strong production experience with Go and gRPC; building complex distributed backend systems Deep knowledge of authentication and authorization: OAuth2, OIDC, RBAC, JWT, token security, session management, cryptography Strong understanding of web security, federated identity, secure coding, and OWASP Top 10 Hands-on experience with AWS, Kubernetes, and Terraform Experience designing high-throughput, low-latency systems with a focus on security and correctness Strong communication skills; able to explain security and architecture trade-offs to technical and non-technical stakeholders Nice to have: Experience with SAML, SCIM, PKI, JWKs/JWKS endpoints, key management (KMS/HSM) and token introspection. Working knowledge of identity platforms (commercial or open source), rate limiting, abuse mitigation, and adaptive authentication. Experience with IntelicsML

Alpaca is looking for a Senior Fullstack Engineer Auth Team to develop and operate authentication authorization and identity-provider services.