Security Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (DevSecOps / AppSec) based in Brazil.

• Implement and maintain SAST, SCA, secret-scanning, and other security controls within CI/CD pipelines across platforms such as Bitbucket, GitHub, and GitLab.
• Operate and continuously improve secrets-management solutions, including HashiCorp Vault and AWS Secrets Manager.
• Monitor repositories for exposed secrets and coordinate remediation with development teams.
• Perform security-focused code reviews for critical features involving authentication, authorization, external integrations, and sensitive data.
• Harden AWS infrastructure and infrastructure-as-code, including IAM policies, Terraform state, VPCs, Security Groups, KMS, and related configurations.
• Support remediation of vulnerabilities and findings identified through security tools, penetration tests, and internal assessments.
• Build and lead a Security Champions program by identifying security focal points within engineering squads and developing continuous enablement initiatives.
• Conduct threat modeling for new features, integrations, and critical architectural changes in partnership with product and engineering teams.
• Define, document, and promote security requirements throughout the SDLC, from architecture and design through deployment.
• Assess the security of internal and external APIs, partner integrations, authentication flows, and other critical application components.
• Develop scripts and automation to support security analysis, vulnerability remediation, and operational efficiency.
• Collaborate with engineering teams to strengthen security awareness, adoption of secure coding practices, and continuous risk reduction.

• Practical experience with CI/CD pipelines and integrating security tooling such as SAST, SCA, and secret scanning into development workflows.
• Solid knowledge of AWS security services and practices, including IAM, S3, Lambda, Security Groups, VPC, KMS, and cloud security principles.
• Hands-on experience with Terraform and the ability to identify and remediate security risks in infrastructure-as-code.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10, with the ability to apply these principles to code and architecture reviews.
• Ability to develop scripts and automations for security analysis and remediation using Python, Bash, or similar technologies.
• Ability to read and understand application code in at least one programming language used within a software product.
• Strong critical-thinking and risk-analysis skills, with the ability to assess vulnerabilities based on business and technical impact.
• Proactive and autonomous approach, with the ability to anticipate risks, take ownership, and drive security improvements through completion.
• Strong interpersonal and communication skills for working closely with software development and engineering teams.
• Collaborative mindset and ability to operate effectively across technical and cross-functional teams.
• Strong ability to explain security concepts clearly and transfer knowledge to developers and other stakeholders.
• Experience with Bitbucket is a plus.
• Practical experience with HashiCorp Vault and/or AWS Secrets Manager is desirable.
• Familiarity with DAST tools such as OWASP ZAP or Burp Suite and their integration into CI/CD pipelines is desirable.
• Knowledge of Docker security and container image repositories is a plus.
• Experience applying CIS Benchmarks to AWS workloads is desirable.
• Familiarity with cloud security posture management tools such as Wiz, Prisma Cloud, AWS Security Hub, or GuardDuty is a plus.
• Experience reviewing serverless architectures involving Lambda and API Gateway is desirable.
• Knowledge of mobile security or binary analysis is considered an additional advantage.
• Relevant certifications such as AWS Certified Solutions Architect, AWS Certified Security – Specialty, Certified DevSecOps Professional, or HashiCorp Vault Associate are desirable.

• Remote work model.
• PJ contract with 30 days of paid rest.
• Health and dental insurance with the monthly premium fully covered, subject to copayments for consultations and exams.
• Life insurance.
• Day off during your birthday month.
• Wellhub membership.
• Complete equipment kit for work.
• Daily transportation allowance of R$22 when working on-site.
• Home-office allowance of R$180 for professionals working remotely at least three days per week.
• Extended maternity and paternity leave.
• Opportunity to work on security initiatives with broad technical impact across cloud infrastructure, applications, and development processes.
• Inclusive opportunities, including consideration for people with disabilities.