Matomo

Information Security Systems Engineer | Cossack Labs

🇺🇦 We stand with Ukraine, and we stand for Ukraine. We offer free assessment and mitigation services to improve Ukrainian companies security resilience.

Back to the list

Information Security Systems Engineer

Kyiv, UkraineLviv, UkraineFull timeFlexible Remote // Analysing and improving information security systems.

The opportunity: #

This position is open exclusively for Ukrainian residents within Ukraine (preferably Kyiv or Lviv).

Cossack Labs is looking for an Information Security Systems Engineer / Officer to join our team. This position might be a good fit if you are interested in analysing risks and improving information security processes and controls in modern technological companies.

We are ready to invest time in your education if you are prepared to work diligently and responsibly. Alongside technical skills, we’ll teach you leadership, time management, business context, and how to keep improving cybersecurity despite the ever-increasing entropy of the world.

We are a data security solutions company, providing custom bespoke solutions to innovative software development teams around the world. Our software is well-known amongst security-aware teams, recommended by OWASP, and popular for easily solving complicated security challenges. Apart from building “off-the-shelf” solutions, we design custom security controls for novel problems.

We work in the B2B space, with customers such as IIoT, AI / ML based systems, mission critical systems, robotics, navigation, power grid operators, payment processors, financial apps, legal companies, million-user customer applications. We cater to young ambitious startups and well-established enterprises, who use our software and solutions as core part of their security arsenal. Our customers are smart, but extremely demanding.

Markets: EU, UK, USA, UA.

Sounds interesting?

You will: #

  • Assess the cybersecurity posture and maturity of client and internal technology organisations, identifying strengths and areas for improvements.
  • Take part in technical security audits of internal infrastructure and client environments. Analyse network architecture, system configurations, identity and access management (IAM), logging and monitoring, patch management, and other core controls.
  • Take part in risk assessment and gap analysis: analyse risk posture, define sensitive assets, describe top risks & threats, identify gaps in security controls coverage, suggest missing controls and policies. Think NIST RMF, NIST SP 800-53.
  • Outline organisation-wide and product-wide security roadmaps and plans.
  • Lead the delivery of cybersecurity improvement programs, coordinating across stakeholders to implement security measures.
  • Select, negotiate and find tradeoffs for security controls that would mitigate high-priority risks (NIST SP 800-53).
  • Design and draft security policies, procedures, standards and controls in line with regulations and/or relevant standards. Think ISO27K, NIST CSF, SOC 2.
  • Maintain and review ISMS documentation, suggest improvements.

We would expect you to have: #

  • 3+ years of experience working as a risk & compliance auditor, information security officer, cybersecurity consultant, or in a similar role.
  • Strong understanding of industry standards in cybersecurity (NIST, ISO, ITIL, ISF).
  • Strong understanding of security and information security controls: which ones solve which problems.
  • Experience in analysis of IT infrastructure, including networks, operating systems, IAM, and endpoint security.
  • Familiarity with cloud security concepts and practices (Azure, AWS or GCP), including cloud-native security controls and shared responsibility models.
  • Familiarity with core security technologies and their use cases, such as SIEM, EDR, EPP, firewalls, DLP, vulnerability management tools, and so on.
  • Upper-intermediate English, written and spoken.
  • Ability to work independently and as part of a team in a fast-paced environment.

As a plus you’d have: #

  • Basic knowledge in cryptography: understanding the differences between symmetric and asymmetric cryptography, hashing, KDF.
  • Experience in automating routine tasks: log processing, searching and detecting atypical system behaviour, etc, both on-premises and in the cloud environments.
  • Understanding of how large distributed systems are built or how they work. Think power plant control systems at country-scale.
  • Desire to work on innovative projects.
  • Experience working in a multicultural context.

Hiring Process: #

  • Resume review – up to 5 business days.
  • Test task – estimated time 3-4 hours.
  • Introductory meeting with the Head of security engineering.
  • Technical interview with several team members.
  • Offer discussion.

Please note that you can be a perfect fit even if not everything we’ve outlined above applies to you. If you have any questions, please don’t hesitate to ask – everyone is unique.

We offer: #

Unique area of expertise: #

  • Interesting and challenging work in applied security engineering: from building to breaking.
  • Working at the intersection of different areas: designing ML security controls, supporting cryptographic protocols with security controls, protecting hardware, building reverse-resilient mobile apps, securing web apps for million of users, etc.
  • Combining technologies: cryptography, software engineering, information security. You won’t be bored :)
  • Public track record in the open source part of our products, sharing your work as blogs posts, research papers and conference talks. We work with innovative companies all over the world, move quickly and dive into technologies others just hear about.
  • A sense of meaning and responsibility for those who seek purpose – we’re building “invisible texture of modern civilization”—bits of infrastructure finance, power grids, healthcare rely on, and we are trusted with very challenging aspects of it.

Environment: #

  • Friendly and experienced team: smart people to learn from, great people to build with. Each of us is unique, we value and support each other.
  • An atmosphere that motivates you to grow and get smarter every month, a healthy ratio of routine / experimentation.
  • Trust: schedule, reporting, bureaucracy is kept at reasonable minimum. We hire smart people and trust them to do the right thing. When things go wrong, we help rather than punish.
  • Shared decision making: this business is driven by engineering excellence, so engineers are important part of tactical and strategical business decisions.
  • Friendly to humans: not just a formal vacation and sick leave quota. Feel like your mental or physical wellbeing needs care? Take some time off. Feel like working a few days from home? Sure. As long as you’re in line, we are here to support you when you’re not.

Growth: #

  • Team that facilitates internal learning and growth all the time.
  • Interesting technologies to work with — sometimes, even unique ones (we design applied cryptography schemes and techniques and novel ways to use them).
  • Interesting engineering challenges across the board, ability to hop from high-level system design to protocol reverse engineering and clever data modelling hacks.
  • Management attention to help you improve upon your personal goals (through 1:1s and mentoring).

Benefits: #

  • Competitive compensation with flexible bonus scheme.
  • Sick leaves, 21 business days for vacation per year, extra days off — according to the agreements and laws.
  • Conferences, books, courses — we encourage learning and sharing with the community. Our team members share a lot in talks, workshops and blog posts.

Not sure but considering? Talk to us. #

If you see yourself fit but a few things are off — don’t hesitate to talk anyway. It might be that your unique combination of skills and knowledge would be perfectly fitting for our environment, but we both just don’t know it yet.

Why work at Cossack Labs? #

Some companies prioritise talent and value proposition, while others understand business and would take any job that pays well. However, only few companies choose to specialise in difficult tasks as their primary competency.

We take on difficult jobs, we take mission-critical software and make it mission-secure.

  • Virtualise OT infrastructure securely in the presence of active adversaries, preventing them from accessing the susceptible nation-wide network? ✓ Check.
  • Provide immediate application security and infrastructure security guidance for mission-critical application that will be deployed on thousands of devices on the front-line tomorrow? ✓ Check.
  • Validate counter-reverse engineering protections for power grid hardware to ensure that previously air-gapped environments were safe to open up to the outside world? ✓ Check.
  • Ensure that software platforms for exchange of sensitive documents actually have a top-tier SSDLC programme that supplements missing capabilities and builds out processes? ✓ Check.

We operate as a lean core team and a diverse network of experts. The finest people you may work with include PhDs in information security and cryptography, infosec community standard contributors, in-depth experts in rare security topics, and business-centric security engineers with broad experiences. Some of your teammates have worked in infosec since the 1990s and saw the industry grow from nothing. Some of them helped write standards that govern security around you. Maybe someone’s work actually keeps the lights up while you’re reading this?

Our core engineers go through extensive indoctrination and training to become disciplined, stringent, self-sufficient field unit who owns the outcomes rather than just showing up for work.

As you grow into the Cossack Labs engineer, you’ll work on slow-paced projects to learn and improve, internal projects to innovate and build tools, and of course a few fires, because no smooth sea can make a skilled sailor. You’ll discover what works for you and what you need to learn.

We help innovators who are launching new venues of civilisation while facing significant security risks in becoming more secure and resilient. Customers trust us to achieve their business goals, not merely address gaps someone else has to identify first.

If this is a challenge you’re up to, let's talk!

How to apply?

We'd like to get your CV to start a conversation. A supporting letter explaining your story and experience in application security, what you have done in the past and what kind of work you find interesting would help, but is not necessary.

Contact us

Get whitepaper

Apply for the position

Our team will review your resume and provide feedback
within 5 business days

Thank you!
We’ve received your request and will respond soon.
Your resume has been sent!
Our team will review your resume and provide feedback
within 5 business days