Cyber Security Manager (SDLC)

Location: On-site in Astana, Kazakhstan, at 55/18 Mangilik El Avenue

Company

Astana International Financial Centre Authority is seeking a cybersecurity professional to support secure software development, application security, and data protection initiatives.

What you will do

• Lead the implementation and continuous improvement of the Secure Software Development Lifecycle.
• Implement SAST and DAST tools and integrate them into CI/CD pipelines.
• Establish secure coding standards, security reviews, application security controls, and threat modeling practices.
• Monitor vulnerabilities, coordinate remediation, and provide security guidance and awareness training to developers and stakeholders.
• Support Microsoft Purview-based Data Loss Prevention, data protection, access management, security monitoring, audits, and compliance reviews.
• Investigate security incidents and requests while supporting cybersecurity procurement, vendor management, and budgeting.

Requirements

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Software Engineering, or a related field.
• At least 3 years of experience in cybersecurity, information security, or application security.
• Hands-on experience with secure SDLC practices, software development teams, and CI/CD environments.
• Practical experience with SAST and DAST tools such as SonarQube, Checkmarx, Fortify, OWASP ZAP, or Burp Suite.
• Strong knowledge of secure coding, OWASP Top 10, threat modeling, vulnerability management, and stakeholder communication.
• Proficiency in English, Russian, and Kazakh is required.

Nice to have

• Master’s degree in a relevant field.
• Familiarity with Microsoft security technologies, including Microsoft Purview.
• Security certifications such as Security+, CEH, CC, CSSLP, GWAPT, or OSWE.

Culture & Benefits

• Full-time, on-site work in Astana.
• Collaboration with development, infrastructure, business teams, internal stakeholders, and vendors.
• Opportunity to contribute to cybersecurity policies, standards, data protection, and secure-by-design practices.