Position: AppSec Engineer for blockchain product
Company: Tacans
Experience required: 3y
Category: Security
English level: upper
Published: 2021-11-01T00:00:00+02:00

Мы ищем AppSec Engineer для своей блокчейн платформы. В поисках специалиста, который поможет разработать план Secure SDLC и внедрит его. Будет знаком с различными векторами атаки, умеет внедрять инструменты и контроли CI/CD, умеет делать Threat Modeling, писать требования для разработчико. Мы строим большой проект на blockchain, а к нему биржи и различные системы в будущем.
As a Swiss company, we embed our core values of quality, efficiency, and reliability into every aspect of our service delivery. Which, thanks to our network of specialists across Eastern Europe, we are able to offer at highly competitive prices.
This is because at Tacans we have an intimate understanding of business's IT needs across the business lifecycle. In fact, Tacans was born out of our founders' firsthand experience of overcoming IT needs and challenges.
Also, we provide immediate outsourcing and outstaffing solutions to businesses worldwide. Our expertise offers trusted full-cycle software services to start-ups, scale-ups, and multinationals in both the public and private space.

**Requirements:**
•	Understanding the details of the secure SDLC approach and has experience in it. Ability to describe goals, steps, approaches, etc. Has ability to lead implementation of security controls in the development team;
•	Solid knowledge of OWASP Top 10 and understanding OWASP testing guide. Ability to describe vulnerabilities, ways of exploitation, and fix methods;
•	Strong knowledge of network and application protocols and their associated security implications (TCP/IP, HTTP, TLS, SSH, DNS, etc.);
•	Experience with programming and scripting languages such as Java, .NET, Python, Bash, PowerShell, etc.;
•	Experience with conducting threat assessments, building threat models, and creating remediation plans based on the results of threat assessments;
•	Experience in implementing and verifying OWASP ASVS;
•	Experience with the OWASP Software Assurance Maturity Modell (OSAMM);
•	Understanding of cryptography. Knows the most popular ciphers and their application. Can assess the proper usage of different types of algorithms;
•	Understanding of risk management, its purpose, and approaches. Understanding the difference and consequences of various risk handling methods (rejection, mitigation, accepting, etc.) Can evaluate risks and create risks management plan;
•	Experience with penetration testing, threat modeling, open-source, and commercial security tools;
•	Ability to develop and conduct security pieces of training and workshops (e.g. General security training, threat modeling);
•	Good communication skills, ability to conduct email communications, lead security-related meetings and discussions,
•	At least Intermediate level of English including cybersecurity-related vocabulary. 

**Responsibilities: **
•	Role: Product security / Application Security / DevSecOps / Security Architecture;
•	Security advisory on projects with different size and technologies;
•	You will be the primary security engineer for software products and act as the point of contact for engineering and security;
•	Design, build and review security-related services and functions of web applications, mobile applications, and desktop applications;
•	Conduct product security threat and risk assessments for software products regularly (OWASP Threat Dragon/MS Threat Modeling Tool); 
•	Classify data and applications based on business risk. Establish a simple classification system to represent risk-tiers for applications;
•	Work with product & development managers for the assessment and prioritization of security-related tasks in the development backlog; 
•	Provide the Engineering teams well-researched security solutions and controls to mitigate risk and fix vulnerabilities;
•	Improves the adoption of security best practices in testing, automation, and continuous integration pipelines. 

**Would be a plus (not mandatory):**
•	Cloud Security (Understands shared security responsibility models for cloud services: IaaS, PaaS, SaaS. Understanding of IAM, principles of cloud security policies, and potential cloud security risks.  Able to effectively implement cloud security improvements); 
•	OSCP Certification;
•	Hashicorp Technologies (Terraform, Vault);
•	Containers and Container Management (Docker, Kubernetes);
•	Config Management (Ansible). 

**Working conditions:**
•	Competitive salary;  
•	Professional, friendly and supportive environment;  
•	Office location near metro Kontraktova Square;  
•	Annual paid vacation (22 working days), 15 paid sick leaves; 
•	Medical issuance program.