Position: Security Analyst (app security)
Company: Raiffeisen Bank
Category: Other
Experience required: 2y
English level: intermediate

Responsibilities:
- Creating security requirements for services and applications
- Building a threat model for systems and services
- Participation in the assessment of information security risks for systems and services
- Analyze identified vulnerabilities as part of information security testing
- Participation in change management

Requirements:
- Competence (preferably experience) in the management and implementation of secure development methods in the SDLC (Secure Software Development Lifecycle).
- Competence in the analysis of existing threats to information security, their relevance, the possibility of implementation and consequences, understanding of ways to implement threats.
- Preparation and analysis of information security requirements for systems / products / components.
- Skills for creating documents in the framework of the direction of information security (Regulations, technical maps, instructions, etc.).
- Competence on threats and vulnerabilities identified as a result of the use of automated testing tools and manual tests.
- Knowledge of the requirements of state regulators in the field of information security.
- Knowledge of information security controls for product solutions.
- Knowledge in the field of information security risk management.
- Carrying out an IS risk assessment for systems / products / services (internal / external vendors).
- Knowledge in the field of organizing methods for protecting mobile applications.
- Knowledge in the field of cryptography. Differences between world standards and state ones.
- Competence in the field of electronic signature.
- Experience in shaping information security requirements for cloud solutions (preferred by AWS).
- Knowledge in building a threat model for information systems and their components.
- Knowledge of the main vulnerabilities of information systems OWASP TOP 10
- An understanding of the organization of web applications, web servers, application technologies, frameworks and protocols in relation to application development and deployment.
- The ability to effectively represent and communicate security threats and risks to any audience and to educate them on mitigation techniques and strategies.
- Familiar with the code management system (for example, BitBucket), the CI / CD building system (for example, Jenkins), the principles of application containerization, the Kubernetes docker container management system, the principles of building a microservice architecture, authentication and authorization methods OAuth 2.0 and OpenID Connect.
- Purposefulness, ability to work independently, ability to negotiate and reach consensus on different priorities of product development teams and solutions.
- English : upper-intermediate

We offer:
- you will work in a large international company that provides possibilities for professional and personal growth.
- involvement into challenging, large-scale and diverse projects which have impact for our customers
- knowledge sharing with colleagues from abroad (strong IT community including 14 Raiffeisen Group Banks).
- 28 days of paid vacation, official employment.
- competitive salary.
- become a part of the professional team of IT Security Raiffeisen Bank.
- health insurance from a local insurance company from first day.