Job Overview
Jibit is looking for a Security Expert to cover both sides of security: detecting and responding to threats, and testing our systems the way an attacker would. You will run and tune our SIEM and EDR platforms (Splunk and Wazuh), lead incident response, carry out penetration tests and red team exercises, and harden our network, infrastructure, and delivery pipeline.

You will work closely with engineering teams to build security into how services are designed, built, and shipped, and help meet the security and compliance requirements that come with payments.

Responsibilities

• Operate, tune, and scale Splunk and Wazuh (log sources, parsing, retention, agents, and integrations); write and maintain detection rules, correlation searches, and dashboards mapped to MITRE ATT&CK, and reduce false positives so that every alert is worth investigating.
• Investigate alerts and security incidents, lead containment and recovery, and write clear incident reports; build and maintain incident response playbooks and run tabletop exercises with the team.
• Run regular penetration tests on web applications, APIs, internal services, network, and Kubernetes environments; coordinate and review external penetration tests and bug reports, and track findings to closure.
• Plan and run red team exercises that test detection and response end to end, then work with the blue side to close the gaps (purple teaming).
• Review and harden network segmentation, firewall policies, remote access, and exposed services; define hardening baselines for Linux servers, containers, and Kubernetes clusters, and check compliance against them.
• Run vulnerability management (scanning, prioritizing by real risk, and following fixes through with owning teams) and improve identity and access controls: least privilege, privileged access, secrets management, and access reviews.
• Add security checks to CI/CD pipelines (static analysis, dependency and container image scanning, secret detection, and infrastructure-as-code checks) and secure the supply chain through build integrity, artifact signing, and trusted base images.
• Run threat modeling and security design reviews for new services and major changes; train developers and engineers on secure coding and common attack paths, write practical security guidelines, and support security policies, audits, and payments compliance requirements.

Qualifications

• 4+ years of experience in security engineering, security operations, or offensive security.
• Hands-on experience running and tuning SIEM and EDR platforms in production, ideally Splunk and Wazuh: onboarding log sources, writing searches and detection rules, and handling alerts.
• Practical penetration testing experience on web applications, APIs, and internal networks; red team experience is a strong plus.
• Good understanding of attacker techniques and how to detect them (MITRE ATT&CK, OWASP Top 10).
• Solid networking knowledge: TCP/IP, DNS, TLS, VPNs, firewalls, segmentation, and traffic analysis.
• Strong Linux administration and hardening skills; working knowledge of containers and Kubernetes security.
• Familiarity with CI/CD pipelines and how to add security controls without blocking delivery.
• Scripting in at least one language (for example Python, Go, or Bash) to automate detection, response, or testing.
• Clear written communication: incident reports, test findings, and guidelines that engineers can act on.
• Comfortable working in Persian and reading and writing technical English.