Sofia Stars is a fast-growing global service provider that guides high-growth businesses to success. Our range of tailored

solutions includes R&D, Customer Support, Sales, KYC, Risk, and Anti-Fraud services. We make every connection shine with fresh

tech and cultural understanding.

Responsibilities:

Demonstrated ability to collaborate with other teams to achieve complex objectives.
Responsible for security architecture design from cloud infrastructure to application through the implementation of "secure by

design" principles.

Collaborate with product managers, architects, and developers on the implementation of the security controls platform ecosystem

and products.

Proof security implementations within infrastructure and application deployment manifests and the CI/CD pipelines.
Define required policies, controls, and capabilities for the protection of products and environments.
Build and validate declarative threat models automation.
Participate in engineering teams’ product planning cycles and committees.
Oversee the product security aspects for migration of products and services from Data Center to public cloud, e.g., AWS.
Serve as a trusted cyber security advisor to product and application teams.

Minimum Requirements:

Experience integrating security scanning/tooling into the development pipeline.
Experience in analysing and securing microservices and applications developed using JavaScript and Typescript.
Experience with CI/CD pipelines (such as Gitlab, Jenkins) and infrastructure-as-a-code models (such as Terraform, Helm, or

CloudFormation).

Hands-on development experience in Python/shell scripting.
Strong understanding of supply chain security, software integrity, and secure software delivery.
Experience with Docker and mesh technologies (such as ISTIO).
Experience with architecture and security reviews, threat modelling, and application risk is highly desired.
Experience working with Agile methodologies.
Knowledge of privacy laws and regulations, such as GDPR desired.
Familiarity with industry regulations, frameworks, and practices. For example, PCI, ISO 27001, NIST, etc.

PREFERRED QUALIFICATIONS:

In-depth experience with architecting secure services on Kubernetes.
Extensive experience with architecting secure services on AWS or on-prem data centers.
Security-related professional certifications e.g., CISSP, CISM, CCSK, CCSP, CEH, are highly desirable.

Our Excellent Benefits:

Up to 25 vacation days
6 undocumented sick leaves
Medical insurance and dental coverage
Sport card 70% coverage (Multisport and/or CoolFit)
Food vouchers (102 EUR)
Appreciation gifts (birthday, wedding, newborn, etc.)
Office massages
Breakfast, lunch & snacks in the office
Education budget
Monthly team events
Great office location

Working Model:

This is an office-based position in Sofia, Bulgaria.

Grow fast, shine globally!

By submitting your application, you agree to our Privacy Policy.

Roll

Application Security Engineer

Kategori

Information Security

Plats

Sofia City

Publicerad

15 juli

Sista ansökningsdag

17 augusti

Källa

Arbetsgivarens hemsida

Taggar för det här jobbet

Information Security

Liknande jobb

Security Automation Engineer

Sofia Stars•Sofia City

Sofia Stars is a fast-growing global service provider that guides high-growth businesses to success. Our range of tailored solutions includes R&D, Customer Support, Sales, KYC, Risk, and Anti-Fraud services. We make every connection shine with fresh tech and cultural understanding. We are looking for a Security Automation Engineer who will focus primarily on building internal services and automation solutions across security and risk management domains. Role Requirements: * Strong hands-on experience with Python (mid-level or higher, able to work independently); * Proven experience building automation services in security and/or risk management domains; * Solid experience with Bash / Shell scripting; * Experience with Git workflows (PRs, CI usage, version control best practices); * AWS (must-have): IAM (roles, policies, AssumeRole), EC2, S3, Lambda, VPC (networking fundamentals), experience with multi-account environments; * Infrastructure & Tools: Docker (build, optimization, debugging), Kubernetes, experience integrating security tools; * Security Knowledge: understanding of IAM misconfigurations, familiarity with OWASP Top 10, basic threat modeling, experience with secrets management (Vault, SOPS, or cloud-native solutions), experience integrating security tools into CI/CD (e.g., Slack, Jira); * Systems Knowledge: Linux (processes, networking, logs), Windows (AD basics, permissions); * English level: B2 or higher. Nice-to-Have: * Experience with Terraform / Infrastructure as Code (IaC); * Familiarity with cloud security tools (e.g., Prowler, ScoutSuite); * Experience with Cloudflare or edge security solutions; * Experience working with large-scale logging pipelines. Duties and Responsibilities: * Design, develop, and maintain security automation services using Python; * Build scalable tools to automate security and risk management processes across multiple departments; * Conduct technical security audits and identify vulnerabilities and improvement areas; * Develop integrations with internal systems and third-party security tools; * Create scripts and services for detecting, preventing, and mitigating security risks; * Integrate security checks and tooling into CI/CD pipelines; * Troubleshoot and debug infrastructure, applications, and automation workflows. Our Excellent Benefits: * Up to 25 vacation days * 6 undocumented sick leaves * Medical insurance and dental coverage * Sport card 70% coverage (Multisport and/or CoolFit) * Food vouchers (102 EUR) * Appreciation gifts (birthday, wedding, newborn, etc.) * Office massages * Breakfast, lunch & snacks in the office * Education budget * Monthly team events * Great office location Working Model: * This is an office-based position in Sofia, Bulgaria. Grow fast, shine globally! By submitting your application, you agree to our Privacy Policy.

Sista ansökan: 17 aug.Publicerad: 16 juli

Information Security

DevSecOps Engineer

Sofia Stars•Sofia City

Sista ansökan: 17 aug.Publicerad: 15 juli

Information Security

Senior Penetration Tester

Sofia Stars•Sofia City

Sofia Stars is a fast-growing global service provider that guides high-growth businesses to success. Our range of tailored solutions includes R&D, Customer Support, Sales, KYC, Risk, and Anti-Fraud services. We make every connection shine with fresh tech and cultural understanding. We invite a Senior Penetration Tester to join our team. Main Responsibilities: ✔️ Lead end-to-end penetration testing engagements across web applications, APIs, mobile, internal and external networks and cloud (primarily AWS). ✔️ Run red-team and assumed-breach operations - initial access, privilege escalation, lateral movement, persistence, exfiltration - including against fraud and detection stacks. ✔️ Perform security reviews of cloud-native services, Kubernetes workloads, CI/CD pipelines, and microservices. ✔️ Discover and exploit vulnerabilities across real-money flows - payments, deposits and withdrawals, wallets, KYC / AML, bonus systems, and affiliate tracking. ✔️ Partner with product, engineering, AppSec, payments, and fraud teams to translate findings into concrete fixes and durable controls. ✔️ Develop custom tooling, scripts, and methodology where no out-of-the-box approach exists. ✔️ Build and validate declarative threat models and contribute to "secure by design" practice. ✔️ Mentor mid and junior testers, review their engagement plans and reports. ✔️ Track new CVEs, TTPs, MITRE ATT&CK updates, and regulator advisories - translate them into concrete changes here. ✔️ Support pre-sales scoping, effort estimation, and pre-certification engagements for new products and jurisdictions. ✔️ Serve as a trusted offensive-security advisor to product, engineering, and compliance teams. Role Requirements: ✔️ Minimum 4 years of hands-on penetration testing or offensive-security experience. ✔️ Proven track record across at least three of: web / API, internal, external network, cloud (AWS / GCP), mobile (iOS / Android). ✔️ OSCP or an equivalent in-the-box certification. ✔️ Strong working knowledge of SAST/SCA/DAST tooling, AWS/GCP, MITRE ATT&CK, OWASP ASVS / WSTG, PTES. ✔️ Understanding of the data flow, MVC model. ✔️ Understanding of supply chain attacks. ✔️ Good reporting skills. ✔️ Comfortable scripting in Python plus Bash. ✔️ Knowledge at least one of major cloud provider's IAM model. ✔️ Experience pentesting cloud-native systems and Kubernetes environments, plus the CI/CD pipelines around them (GitLab, GitHub Actions, Jenkins) and IaC (Terraform, Helm, CloudFormation). ✔️ Strong written and verbal communication in English. ✔️ Experience balancing security and business demands under release pressure. ✔️ Familiarity with industry regulations, frameworks, and practices: PCI DSS, ISO 27001, NIST, GDPR. PREFERRED QUALIFICATIONS: ✔️ One of offensive-security certifications: OSWE, OSEP, OSED, CRTO, BSCP, ARTE, GRTE. ✔️ In-depth experience architecting secure services on Kubernetes and AWS. ✔️ Prior iGaming, fintech, or payments domain experience. ✔️ Public CVEs, advisories, write-ups, conference talks. ✔️ HTB Pro Lab completions, real CTF placements. ✔️ Open-source contributions to offensive or defensive tooling. Our Excellent Benefits: * Up to 25 vacation days * 6 undocumented sick leaves * Medical insurance and dental coverage * Sport card 70% coverage (Multisport and/or CoolFit) * Food vouchers (102 EUR) * Appreciation gifts (birthday, wedding, newborn, etc.) * Office massages * Breakfast, lunch & snacks in the office * Education budget * Monthly team events * Great office location Working Model: * This is an office-based position in Sofia, Bulgaria. Grow fast, shine globally! By submitting your application, you agree to our Privacy Policy.

Sista ansökan: 17 aug.Publicerad: 15 juli

Information Security