Position: DevSecOps Engineer, Financial Systems
Company: DataArt
Category: DevOps
Experience required: 3y
English level: upper

About the vacancy
We are assembling a team that will develop and upgrade the systems of the international association of financial industry professionals. The company unites 200 thousand investment experts and uses more than a hundred different applications, many of which are developed using NetSuite.

Advanced technological solutions, skilled technical specialists, and the importance of human relations is what makes the work on projects of this company comfortable and interesting. Minimum viable bureaucracy and openness to new solutions allow every developer to significantly influence the products created.

The DataArt team will be expanded to several dozens of people in the future: developers, testers, architects. A NetSuite Architect will act as a partner and consultant to the client's technical manager: help understand vendor recommendations, make strategic decisions about the development of the company's services.

Responsibilities
Receive vulnerability reports such as Information Security Office Penetration Test or Red Team Exercises and partner with different teams to resolve any issues
Work with IT Development and Enterprise Architecture teams on new technology initiatives so that solutions are designed with best security practices and requirements in mind
Partner with IT Quality Assurance to introduce security testing to the software development lifecycle focusing on test automation
Locate application vulnerabilities using tools such as Static and Dynamic Code Analysis and resolve issues before product releases focusing on test automation
Collaborate with Delivery Operations and Cloud Operations teams to enhance software release processes and provisioning of cloud-based services while also mitigating security risks
Collaborate with Information Security Office to examine new threats in the environment, modify current SDLC or CI/CD processes if needed
Partner with IT Operations to improve or change any tools, logs, or notifications
Collect audit evidence for Information Security Office for audit and compliance checks
Collaborate with Information Security Office to raise awareness of possible application vulnerabilities and best development practices (Securing Network Protocols, OWASP, CIS Controls)
Must have
10+ years of experience in information technology
Ability to handle confidential and sensitive information
Excellent multitasking, interpersonal, and communication skills, good English
Strong knowledge of IT infrastructure
In-depth understanding of common software related exploits in programming languages, web applications, and network protocols (SSL, HTTPS, TLS, HSTS, OWAST TOP 10)
Familiarity with automated vulnerability scanning tools (Tenable, Qualys, CVE Scan Tools)
Proficiency in scripting and cross platform integrations, service/web hooks (JIRA, Azure DevOps, Octopus Deploy, Azure Portal, ARM Templates, PowerShell and other CLIs)
Fluency in Web Application Firewalls and common configurations (CloudFlare)
Understanding of network monitoring, analysis, troubleshooting, and configuration control technologies
Excellent understanding of cybercrime tactics, from Script Kiddies to Advanced Persisted Threats
Some knowledge of reverse engineering and malware analysis (dynamic and static)
Excellent problem solving skills
Willingness to learn modern technologies
Ability to support the objectives of IT Operations and the Information Security Office
Ability to perform on-call duties is a plus