Lead Engineer – AppSec

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Act as the primary technical authority on security for Product and Engineering teams, ensuring security is embedded early in the development process.

• Facilitate threat modeling sessions for new features and changes in architecture.

• Perform security code reviews and manual testing for web applications, APIs, and mobile applications.

• Establish, maintain, and optimize SAST, DAST, SCA, and secret detection tools within CI/CD pipelines.

• Assess, prioritize, and manage vulnerabilities, assisting developers with remediation.

• Develop secure coding standards and guidelines that encompass authentication, authorization, encryption, and personal data protection.

• Foster a culture of security awareness through training initiatives.

• Assist with compliance efforts related to LGPD, ISO 27001, and SOC 2.

• Engage in incident response processes involving applications.

• Evaluate the current landscape of application security, tools, vulnerability backlogs, and product risks across Gupy.

• Improve SAST, SCA, and secret detection within pipelines for critical repositories, minimizing false positives.

• Establish triage and prioritization processes with SLAs and metrics for remediation.

• Integrate threat modeling into the development of high-risk features.

• Publish security standards and checklists for the Engineering team.

• Conduct or oversee penetration testing for critical applications and APIs, ensuring remediation plans are agreed upon with relevant teams.

⛳️ Requirements

• Extensive experience in application security or software development with a strong emphasis on security.

• Comprehensive knowledge of the OWASP Top 10 and OWASP API Security Top 10.

• Familiarity with injection vulnerabilities, XSS, IDOR, SSRF, authentication failures, and access control issues.

• Proficiency in reading and reviewing code, particularly in JavaScript/TypeScript (Node.js).

• Practical experience with tools such as Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, or similar.

• Background in integrating security checks within CI/CD pipelines, including GitHub Actions and Jenkins.

• Understanding of OAuth 2.0, OpenID Connect, and JWT.

• Experience in vulnerability management, triage, prioritization based on criticality, and tracking remediation efforts.

• Excellent communication skills, capable of translating technical risks into business implications and fostering partnerships with Engineering teams.

• Preferred: familiarity with AWS, container security, and Kubernetes.

• Preferred: understanding of Terraform for security in infrastructure-as-code.

• Preferred: experience with threat modeling in microservices architectures.

• Preferred: OSCP, OSWE, CSSLP, or equivalent certifications.

• Preferred: knowledge of LGPD, ISO 27001, and SOC 2.

• Preferred: experience in SaaS companies managing large quantities of personal data.

🏝️ Benefits

• Meal allowance provided via a Caju card.

• Fully funded medical plan by Gupy for you, with copayments for eligible dependents.

• Dental plan included.

• Life insurance policy.

• Home office allowance.

• Physical wellness support through Wellhub and TotalPass.

• Starbem, offering online telemedicine and wellness services, including an initial complimentary offer of four psychology sessions, one nutrition session, and medical consultations.

• Guapeco, a pet health plan with reimbursement available at any veterinary clinic in Brazil.

• Six months of maternity leave.

• Extended paternity leave options.

• Parental leave policy applicable to same-sex couples, non-gestational mothers, and adoption scenarios.

• Five days of marriage leave.

• Internal recognition through Gupy Coins, redeemable as credit on a Caju card.

• Day off for your birthday.

• Creditas payroll-deducted loan options.

• Financial education provided by Creditas.

• Access to the Creditas Store.

• Férias&Co, offering annual travel credits with part of the monthly fee subsidized.

• Opportunity to become a shareholder in Gupy.

• Career paths available with both management and technical-track options.

• Opportunities for learning, challenging assignments, and promotions.