Security Risk Manager

Responsibilities:

• Creating security requirements for services and applications
• Building a threat model for systems and services
• Participation in the assessment of information security risks for systems and services
• Analyze identified vulnerabilities as part of information security testing
• Participation in change management

Requirements:

• Competence (preferably experience) in the management and implementation of secure development methods in the SDLC (Secure Software Development Lifecycle)
• Competence in the analysis of existing threats to information security, their relevance, the possibility of implementation and consequences, understanding of ways to implement threats
• Preparation and analysis of information security requirements for systems / products / components
• Skills for creating documents in the framework of the direction of information security (Regulations, technical maps, instructions, etc.)
• Competence on threats and vulnerabilities identified as a result of the use of automated testing tools and manual tests
• Knowledge of the requirements of state regulators in the field of information security
• Knowledge of information security controls for product solutions
• Knowledge in the field of information security risk management
• Carrying out an IS risk assessment for systems / products / services (internal / external vendors)
• Knowledge in the field of organizing methods for protecting mobile applications
• Knowledge in the field of cryptography. Differences between world standards and state ones
• Competence in the field of electronic signature
• Experience in shaping information security requirements for cloud solutions (preferred by AWS)
• Knowledge in building a threat model for information systems and their components
• Knowledge of the main vulnerabilities of information systems OWASP TOP 10
• An understanding of the organization of web applications, web servers, application technologies, frameworks and protocols in relation to application development and deployment
• Familiar with the code management system (for example, BitBucket), the CI / CD building system (for example, Jenkins), the principles of application containerization, the Kubernetes docker container management system, the principles of building a microservice architecture, authentication and authorization methods OAuth 2.0 and OpenID Connect
• Purposefulness, ability to work independently, ability to negotiate and reach consensus on different priorities of product development teams and solutions
• English: upper-intermediate

We offer:

International business career: work in a large international company that creates a diverse and inclusive environment for professional and personal growth. Strong Raiffeisen community of highly professional and successful teams from different countries.

Challenging WOW-projects: involvement into large-scale projects on product development, using modern engineering technologies, unique approach to encouraging customer-driven innovation.

Comfortable and safe format of work: flexible work conditions including remote work or hybrid models alternating between in-office hours and remote work. Offices with uninterruptible power supply and bomb shelters are provided to perform duties.

Professional development: knowledge sharing with colleagues from abroad, development within the company, upskilling and reskilling opportunities, internal competitions. The possibility of obtaining a T-shaped expertise. Internal and external training programs. Corporate English courses. Soft skills trainings at our corporate L& D academy. Team building activities and involvement into social projects.

Attractive social package and wellbeing: 28 days of paid vacation, medical insurance, official employment. Mental and Physical health support: individual psychological sessions and lectures, -free online workouts, yoga.

Stable income: competitive salary and bonuses for your efforts and contribution, rewards for participation in the referral program.