Application Security Specialist, AppSec

atLEO Learning BrasilRemote

Brazil Freelance Cybersecurity / Security EngineerMid-levelSenior

Posted 2 days ago

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Safeguard the security of Revvo’s applications and digital solutions.

• Identify, analyze, classify, and monitor the resolution of vulnerabilities in PHP applications.

• Conduct source code assessments targeting the OWASP Top 10.

• Execute security testing (penetration testing) on web applications, APIs, integrations, and services.

• Implement and manage SAST, DAST, and SCA tools.

• Evaluate vulnerabilities in PHP libraries, frameworks, components, and third-party dependencies.

• Assist developers in applying fixes and adhering to secure coding best practices.

• Evaluate authentication, authorization, access control, session management, and data protection measures.

• Integrate automated security controls within development workflows and CI/CD pipelines.

• Assess security risks associated with products using artificial intelligence, including integrations with AI models, data exposure, prompt injection, and API misuse.

• Aid in security incident analysis, vulnerability investigations, and the establishment of preventive actions.

• Review security configurations for servers, applications, cloud services, and WAFs.

• Generate technical reports, document evidence, establish remediation priorities, and track security metrics.

• Participate in architecture evaluations and drive ongoing enhancements of product security practices.

• Respond to customer security inquiries related to digital products.

• Collaborate with development teams to advocate for secure coding, data protection, API security, and the incorporation of controls throughout the development lifecycle.

⛳️ Requirements

• Bachelor’s degree in Computer Science, Software Engineering, Information Systems, Information Security, Computer Engineering, or a related discipline.

• Relevant training in secure PHP development and web application security.

• Familiarity with the OWASP Top 10 and OWASP API Security Top 10.

• Knowledge of vulnerability assessment and security testing methodologies.

• Understanding of REST API security and OAuth 2.0/OpenID Connect authentication protocols.

• Awareness of DevSecOps, Git, and security integration within CI/CD processes.

• Knowledge of cloud security and application infrastructure.

• Understanding of security practices for artificial intelligence applications and LLMs.

• Knowledge of dependency analysis, CVE management, and vulnerability remediation strategies.

• Solid experience in Application Security (AppSec), PHP, secure architecture, and DevSecOps.

• Capability to define corporate secure development standards and AppSec policies.

• Proficiency in SAST, DAST, SCA, code review, and security control automation.

• Advanced understanding of cloud security, authentication, authorization, cryptography, and data protection.

• Ability to evaluate critical vulnerabilities, assist in incident investigations, and establish mitigation strategies.

• Experience in defining SSDLC processes and integrating security into the development lifecycle.

• Knowledge of artificial intelligence security, including risks related to LLMs, information leakage, prompt injection, and interactions with external services.

• Ability to establish security metrics, vulnerability indicators, remediation SLAs, and improvement roadmaps.

• Experience in providing technical guidance to developers and security professionals.

• Experience with threat modeling, risk analysis, and secure architecture for applications and APIs.

• Certifications such as ISC2 Certified in Cybersecurity (CC), CSSLP, Burp Suite Certified Practitioner (BSCP), CompTIA Security+, or cloud security certifications are a plus.