Sergey Belov Email & Phone Number

Russia

Moscow, Russia

- Led drafting and implementation of various security features to enhance overall security posture of the company.- Maintained endpoint security management systems (Kolide and Jamf), resulting in improved endpoint security.- Implemented various custom checks for Kolide, which improved the accuracy and efficiency of security monitoring.- Maintained and managed the company's Web Application Firewall (WAF) using Cloudflare WAF.- Implemented a secure software development life cycle (SSDLC) in Gitlab (using various tools Bandit, Semgrep, Trivy, Kubesec, Gemnasium) and JFrog Artifactory, resulting in a marked improvement of the company products security.- Conducted regular security code review for company products (Python and Javascript), resulting in the identification and remediation of various critical security vulnerabilities.- Led penetration testing of company product by an external contractor.- Implemented Zero Trust architecture using Cloudflare ZTNA and Teleport.- Implemented security events aggregation to Slack using Cloudflare Workers, which improved the efficiency and effectiveness of security incident management.- Led various in-house security trainings, including code review from security perspective, common payment processing issues, and phishing awareness.

Москва, Россия

- Led security assessments, penetration testing, tooling scans, and source code audits for an AI development platform, public deep learning framework infrastructure, hardware AI computing platform and various other products with a 10-person team.- Led security testing tools development.- Supervised security research projects.- Served as the SME for all application security, threat modeling, and vulnerability solutions.- Completed 20+ internal security testing projects for web applications, hardware platforms, end-user products, and IDE.- Discovered a 0-day vulnerability in the open-source product with a security risk of accessing user credentials.- Served as a mentor for junior engineers and gave an in-house lecture for staff on application security.- Received an Individual Award of the President of the Moscow Research Center.

Москва, Россия

- Led a team of 5 security professionals to deliver 15 internal & external security projects and penetration testing initiatives.- Provided penetration testing for enterprise banking infrastructure, technical brand protection for a mobile operator, antifraud measures for an oil and gas company, and a security roadmap for a medical holding company.- Improved project report templates and client questionnaires to streamline project cost assessments and negotiations.- Participated in modernization of the access control system, improved the security of employee workstations, increased the frequency of hardware firmware update cycles, and updated the system for monitoring data leaks of company employees.- Built an internal information security knowledge base used by the Head of Cybersecurity and all staff, to streamline commercial offer quality, formation speed, reporting, and document preparation time in the field of information security.- Won 1st place in the internal information security competition out of 1,000+ KPMG participants across the globe.

Москва, Россия

- Led 30+ Penetration testing projects for payment processing systems and ICO projects with a team of 3 testers.- Developed 5 vulnerability detection modules for Nessus Professional and discovered six 0-day vulnerabilities.

- Conducted external and internal penetration testing of 25 web applications, including source code audits with PHP/Node.js, for 20 gambling, trading platforms, banking, and credit companies.- Reduced costs by 10% by developing data collection and node deployment/configuration tools to streamline penetration testing process.

- www.group-ib.ru, Group-IB: Completed 7 penetration testing projects for financial sector clients. Conducted application security assessments using manual and automated penetration techniques with Burp Suite, Nessus, Acunetix, and OpenVAS. - deteact.com, DeteAct: Conducted application security assessments and penetration tests for 4 web & mobile applications. Manually tested and analyzed results and developed scripts & tools & automated application vulnerability scanning/testing. - 1gsecurity.com, 1Guard: Conducted penetration testing of external/internal network infrastructure and prepared reports.

- Built an OpenSSL-based cryptographic module for GOST algorithms (28147-89, 34.11-94, 34.10-2001) and a certificates management plugin according to Public-Key Cryptography Standard.- Implemented a Kernel-mode cryptographic module for GOST algorithms, a custom map module based on Qt Marble, firewall procedures for a network filtering kernel module, and a minor kernel module for maintenance.- Increased performance 10x by implementing a packet reordering mechanism with a lock-free queue and distribution of interrupt processing among processor cores.- Developed a cross-platform Win, Linux, and Solaris software licensing mechanism for license generation and validation and kernel-mode integrity checking module, eliminating a reliance on third-party software and decreasing operational costs.- Implemented necessary improvements to pass certification for compliance with FSTEC requirements.- Increased network data transmission speed by porting a Deflate compression algorithm for kernel-mode IPComp module.