Стажер по информационной безопасности

#LI-REMOTE #LI-JC2

About the Role

We're looking for a Senior Cyber Security Operations Analyst to design, build, and scale secure enterprise development and QA environments across Azure-based software delivery ecosystems. You'll enhance Azure DevOps platform capabilities, improve CI/CD pipeline architecture, and integrate security throughout the software development lifecycle. This role works closely with Engineering, QA, Release Engineering, Platform Engineering, and Product Security teams to improve build reliability, deployment consistency, and operational efficiency. 

Due to the fact that this position will deal with highly sensitive data and will support federal customers, we are only considering US citizens at this time. Security clearance is not required, but there is a slight chance it maybe requested in the future 

What You’ll Do

• Design, implement, and enhance Azure DevOps platform capabilities, including reusable CI/CD templates, pipeline standards, and developer enablement tooling
• Build and optimize secure CI/CD pipelines supporting multiple product lines, integrating security scanning, secrets management, artifact validation, and policy enforcement
• Build and support scalable development and QA environments, improving provisioning, configuration management, and deployment automation
• Implement and maintain infrastructure-as-code solutions using Terraform, Ansible, and PowerShell across Azure cloud environments
• Partner with Product Security and Infrastructure teams to embed secure-by-design principles into SDLC workflows and support vulnerability remediation initiatives
• Monitor CI/CD platform health and troubleshoot pipeline failures, deployment issues, and environment-related problems
• Mentor junior engineers and promote DevSecOps best practices across Engineering, QA, Security, and Infrastructure teams 

Technologies You’ll Work With

• CI/CD platforms: Azure DevOps, GitHub Actions, Jenkins
• IaC and automation: Terraform, Ansible, PowerShell, Python, Bash
• Containerization: Docker, Kubernetes
• Cloud: Azure (primary), with familiarity across AWS or GCP
• Security tooling: SAST, SCA, secrets management, artifact repositories
• Agentic AI and modern automation approaches

What You’ll Bring

• 8+ years of experience in DevSecOps, DevOps, Platform Engineering, or Build Engineering
• Strong hands-on experience with Azure DevOps, CI/CD pipeline engineering, and build and release automation
• Experience with Terraform, Docker, Kubernetes, Git, PowerShell, Python, and Bash
• Solid understanding of DevSecOps practices, IaC, Secure SDLC, and cloud security
• Experience with software supply chain security frameworks (SLSA, NIST SSDF, OWASP SCVS)
• Bachelor's degree in Computer Science, Engineering, or equivalent experience 

Bonus Skills

• Experience implementing agentic AI engineering and development solutions
• Relevant certifications such as Azure DevOps Engineer Expert, CDP, GCSA, CCSP, CKS, or HashiCorp Terraform Associate
• Experience in regulated or compliance-driven environments
• Familiarity with policy enforcement workflows, artifact repositories, and secrets management platforms 

About the Role

Veeam VDC Security Engineering builds and operates the security platform for a multi-cloud (Azure and AWS) SaaS serving regulated industries. This role sits in Platform Security and helps drive AI/LLM security as a discipline. You will help shape how VDC uses large language models safely (defensively, at scale) and how we use them offensively to find and fix real security defects faster than traditional programs allow.

What You’ll Do

• Design and ship the data-handling controls (code, filters, and infrastructure guardrails) for VDC's internal AI tooling and the AI features in our product. Redact sensitive data from prompts, model context, logs, and outputs before any of it reaches a third-party model provider
• Build and productionize an AI-enhanced vulnerability reduction capability that plugs into CI/CD, surfaces real defects with a low false-positive rate, and either recommends or applies remediation without eroding developer trust
• Publish and evolve a self-serve secure-LLM-use pattern for other VDC engineering teams, including input filtering, output validation, provider-tier data classification, and threat-model shortcuts for teams adding AI features to their products
• Threat-model internal AI tools for prompt injection, indirect prompt attack surfaces, model exfiltration, and agent-tool boundary weaknesses. Partner with the red team on findings, then build the fixes and guardrails with tool owners
• Partner with Compliance to shape auditor-facing evidence for AI-assisted controls, including which evidence formats hold up when the collector was an LLM and where human review must gate disclosure
• Contribute the AI-security lens to adjacent Security Engineering programs where LLMs touch the surface area: vulnerability management maturity, supply chain risk reduction, code owners routing, and compliance evidence collection
• Set VDC's direction on emerging LLM security tools and internal AI-forward workflows: what to adopt, what to skip, and what to build in-house

Technologies You’ll Work With

• Azure OpenAI Service and other Azure AI Foundry components
• Anthropic Claude, OpenAI, and multi-provider LLM APIs used across VDC internal tools
• Microsoft Presidio, custom redaction pipelines, or equivalent PII/secrets detection at the prompt boundary
• Cycode (SAST / SCA / Secrets) and Wiz for signal fusion into AI-driven remediation
• GitHub Actions and Azure DevOps for CI/CD integration of security-review LLM tooling
• Python and Go for the AI security tooling stack; comfort reading PowerShell and TypeScript for integration points
• Microsoft Sentinel and Log Analytics for the audit trail on AI-mediated security operations

What You’ll Bring

• 10+ years across security and engineering, with recent focus on AI/ML systems in production (LLM deployments, model risk, or AI-driven security tooling)
• Hands-on experience shipping controls (Code, infra or data gaurdrails) that operate on LLM inputs and outputs (redaction, filtering, output validation, prompt-injection defense)
• Build and tune detection systems that catch PII and secrets (API keys, credentials, personal data) across large, messy datasets, knowing when a regex rule is good enough, when you need a trained classifier, and when only an LLM can catch it, and justifying that choice on cost, latency, and accuracy grounds
• Track record of taking AI/security work from concept to production, including designing for developer trust and false-positive management
• Strong cloud security fundamentals across Azure and AWS: RBAC, secret management, key handling, network egress controls
• Turn ad-hoc "is this LLM use case safe?" questions into a reusable mechanism (a scoring rubric in PR templates, a lint rule, an approval gate) that teams run themselves, instead of a doc they read once or a person they ping
• Comfort building and hardening security tooling in Python and Go
• Familiarity with regulated-industry evidentiary expectations (SOC 2 Type 2, ISO 27001, FedRAMP, HITRUST) and how AI-generated evidence intersects with them
• Hands-on experience with agentic AI development environments (Claude Code, Cursor, GitHub Copilot Enterprise) and their operational security implications
• A demonstrable track record of shipping production code (a code portfolio, open-source contributions, or internal build history). This is a hands-on building role, not an advisory one

Bonus Skills

• Familiarity with LLM attack techniques (prompt injection, indirect prompt attacks, tool-boundary abuse, model exfiltration) enough to threat-model and build defenses
• Background in traditional AppSec or SAST that translates cleanly to LLM-augmented vulnerability finding
• Contributions to open-source LLM safety or evaluation projects (Presidio, PromptFoo, Garak, etc.)
• Prior work with Azure OpenAI Service enterprise data-handling controls and LLM governance patterns
• Experience integrating security tooling into developer workflows without becoming a merge-blocking bottleneck

#LI-SO2

ПК «Аквариус» – ведущий российский разработчик, производитель и поставщик компьютерной техники и ИТ-решений для государственных и корпоративных заказчиков. В 2021 «Аквариус» стал 4-м в рейтинге CNews Analytics среди крупнейших российских IT-разработчиков.

Компания основана в 1989 году и сегодня располагает собственным производством международного уровня мощностью более 800 тыс. устройств в год и сетью сервисного обслуживания в 135 городах России.

Наша Компания активно развивается и растет, именно поэтому для нас так важно привлекать в свою команду только лучших - с высоким уровнем профессионализма и вовлеченности!

Добраться можно на корп. транспорте от м. улица 1905 г., Народное ополчение и м. Крылатское, есть бесплатная парковка.

Инженер по защите информации от утечки по техническим каналам

Основные задачи:

• Выполнение работ, связанных с проведением аттестационных испытаний, контролем защищённости информации, обрабатываемой на объектах информатизации, предусматривающих:

• Проведение оценки защищенности от утечки по техническим каналам;

• Подготовку отчетных материалов по результатам работ.

Требования:

• Высшее образование по направлению деятельности/подготовки (специальности) в области информационной безопасности или иное высшее в соответствии с действующими профессиональными стандартами в области защиты информации;

• Знание требований нормативно-методических документов в области защиты информации от утечки по техническим каналам;

• Опыт работы в указанной области;

• Владение соответствующими средствами инструментального контроля защищенности информации;

• Готовность к периодическим командировкам.

Мы предлагаем Вам:

• Стать частью крупной стабильной компании разработчике и производителе компьютерной техники и IT‑решений, успешно развивающейся на российском рынке уже более 30-ти лет;
• Возможность профессионального роста и развития;
• ДМС после испытательного периода;
• Грамотная система адаптации;
• Возможность обучаться за счет компании (повышение квалификации);
• Развитая корпоративная культура;
• Оформление в соответствии с ТК РФ;
• Удобный корпоративный транспорт (8-15 мин. от метро ул. 1905 г., народное ополчение и м. Крылатское), бесплатная парковка возле офиса.
• График работы 5/2 с с 9.00 - 18.00, работа из офиса.
• Ждем Ваше резюме! В отклике просим указывать релевантный опыт и финансовые ожидания.