Position: CISO
Category: Security
English level: intermediate
Years of experience: 11

From scratch I prepared the company for ISO 27001 certification.
An approval process for granting access rights has been introduced.
A testing process has been introduced to penetrate the software development life cycle.
Security Engineer for a public cloud SaaS application.
Identification of information resources.
Identification of business processes.
Identifying vulnerabilities, threats, calculating risks.
Development and implementation of information security standards and policies.
Training and consulting on information security.
Information security audit.
Protection of information services.
Monitoring of security events and incidents management SIEM OSSIM.
Conducting employee training.
Development and implementation of continuous operation of information systems according to ISO 22301.
Implementation of the agreement for access to information services based on software JIRA.
Conducting test pins (scanning web resources close 1500 the experience in application-level vulnerability testing (e.g. Cross Site Scripting, SQL Injection, LDAP Injection, Cross Site Request Forgery, Insecure Cryptographic Storage, etc.). Use Kali Linux tools (OWAPS zap, mantra, nikto, nmap, sqlmap, vega, wpscan, skipfish, metasploit, Beef, wireshark, maltegoce, nessus, openvas …) for testing).
Experience with common vulnerability scanning and reporting tools (e.g. SonarQube, WhiteSource, Black Duck).
use Open Source Security Testing Methodology Manual (OSSTMM) and NIST.
use Penetration Testing Execution Standard (PTES).
participation in SDLC (Software development lifecycle).
use the OWASP testing project.
New projects, development towards SecDevOps and penetration testing web applications