Application Security Engineer – AppSec Fintech

This is a fully remote position, open to applicants in Latin America.

📋 Description

• Report to the CISO and safeguard the cloud as well as web and mobile applications of Retorna.

• Review and ensure the configuration of AWS (IAM, networks, storage, encryption, and logs).

• Establish hardening baselines in alignment with CIS Benchmarks.

• Monitor the cloud security posture (CSPM).

• Review infrastructure as code (Terraform or CloudFormation) prior to deployment.

• Integrate SAST, SCA, secret detection, and DAST into CI/CD pipelines.

• Conduct threat modeling and code and API reviews focusing on OWASP Top 10, OWASP API Security Top 10, OWASP Top 10 for LLM Applications, and OWASP MASVS.

• Support developers in remediation efforts and promote a culture of secure development with security champions.

• Execute internal pentests on web applications, mobile apps, APIs, and cloud within an authorized scope.

• Coordinate external vendor pentests up to retesting.

• Simulate techniques based on MITRE ATT&CK during purple team exercises.

• Manage the vulnerability lifecycle in Jira, from risk prioritization to closure verification.

• Provide technical evidence to GRC for ISO 27001 compliance.

• Collaborate with Engineering, Platform/DevOps, IT, GRC, and Technology Risk.

⛳️ Requirements

• 2 to 4 years of experience in cybersecurity, focusing on cloud security, application security, or pentesting.

• Hands-on experience securing environments in AWS (or another public cloud, with a willingness to work in AWS).

• Experience executing pentests on web applications and/or APIs and drafting reports with findings and recommendations.

• Solid knowledge of OWASP Top 10 and the ability to explain vulnerabilities and their remediation to developers.

• Proficiency in reading code in at least one modern programming language and the ability to write scripts.

• Technical reading proficiency in English.

• Bonus points for holding offensive certifications (OSCP, eJPT/eCPPT, PNPT, BSCP) or cloud and defensive certifications (AWS Certified Security Specialty, CCSK, BTL1, GCIH).

• Experience in mobile application security testing (Android/iOS).

• Experience implementing DevSecOps in CI/CD pipelines.

• Background in fintech, banking, or regulated industries.

• Participation in bug bounty programs, CTFs, or contributions to the security community.

🏝️ Benefits

• Permanent contract.

• 40 hours/week.

• 35 days of annual vacation.

• 100% remote work from LATAM.

• Unlimited days off.

• Direct impact on building the Cybersecurity function of a growing fintech.