Mid-Level Analyst, Offensive Security

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Safeguard RecargaPay’s applications and financial services in collaboration with engineering teams.

• Assist the team’s Application Security efforts by monitoring vulnerabilities from identification through resolution.

• Evaluate and prioritize vulnerabilities, provide guidance to teams, and confirm fixes through retesting.

• Manage SAST, SCA, and automated code review results, distinguishing false positives and escalating true vulnerabilities with the necessary context.

• Contribute to threat modeling and participate in feature design reviews.

• Execute security code assessments on pull requests.

• Carry out penetration tests on web applications, APIs, and mobile applications within specified scopes, delivering reproducible evidence and comprehensive impact assessments.

• Assist in the evaluation of external findings, such as bug bounty submissions and consultancy penetration tests, by reproducing and validating vulnerabilities.

• Mentor Security Champions on remediation strategies and secure development best practices.

• Develop and sustain automation tools and AI agents to enhance the team’s efficiency.

• Acquire deep knowledge in one of the following domains: Adversarial Security, AI Security, or Security Automation.

• Present the quarterly roadmap for the chosen area of expertise.

• Collaborate on an AI-first team, utilizing automation and AI agents regularly, while receiving guidance from a senior team member.

⛳️ Requirements

• Proven experience in Application Security or application penetration testing, with a strong understanding of the OWASP Top 10 and OWASP API Security Top 10.

• Experience collaborating with development teams to oversee vulnerability remediation.

• Proficiency in reading code in at least one backend programming language: Java, Kotlin, Go, Python, or Node.js.

• Familiarity with SAST, SCA, or DAST tools and tools like Burp Suite or a comparable solution.

• Scripting skills in Python or Go.

• Competency in technical English for understanding documentation, advisories, and research materials.

• Degree in technology or a related discipline, or equivalent professional experience.

• Preferred: Experience in web and API penetration testing focusing on business logic and authorization, or mobile penetration testing for Android and iOS, including use of Frida and Objection.

• Preferred: Knowledge of LLM, agent, and MCP security, encompassing prompt injection, tool abuse, and authorization challenges.

• Preferred: Experience integrating security into CI/CD pipelines and creating automations with n8n or AI agents.

• Preferred: Background in a regulated financial setting, including PCI DSS, Brazil’s LGPD, and BACEN standards.

• Preferred: Relevant certifications such as BSCP, eWPT, OSCP, or equivalent.

• A sense of ownership over your responsibilities, a thirst for technical knowledge, strong communication with engineering teams, sound risk judgment, collaborative spirit, an AI-first approach, and ethical conduct when accessing privileged information and managing sensitive data.

🏝️ Benefits

• Competitive salary aligned with market standards.

• Flexible remote work — you’re part of the team, no matter where you are!

• Monthly home office allowance credited through the RecargaPay app.

• Comprehensive health and dental insurance with no copayment required.

• Life insurance coverage.

• Flexible meal allowance via Flash.

• Access to TotalPass to promote your health and well-being.

• Commitment to diversity and inclusion at RecargaPay.

• Opportunity for your data to be considered for other roles within the RecargaPay group, pending your consent and adherence to applicable LGPD regulations.