Mid-Level Code Review Analyst

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Oversee the ticket queue, actively select tasks, and manage cases from initiation to resolution.

• Monitor assigned cases to ensure they are resolved within set deadlines.

• Evaluate SAST and SCA findings to determine if mitigations effectively lower application risk.

• Investigate application behavior, architecture, data flows, and source code to clarify security findings and identify false positives.

• Offer developers clear and practical advice on addressing source-code vulnerabilities.

• Work collaboratively with internal development teams via Microsoft Teams, phone calls, and written correspondence.

• Share insights to enhance services, processes, and the adoption of new technologies within the team.

⛳️ Requirements

• In-depth knowledge of application security principles, including application architecture and data flows.

• Strong understanding of the OWASP Top 10 with the ability to connect vulnerabilities to code-level fixes.

• Background in software development, architecture, software QA, or application security engineering.

• Practical experience in at least one of the following languages: C#, C++, Java, .NET, Node.js, or Python.

• Capability to evaluate SAST/SCA findings, analyze false positives, and assess mitigations.

• Self-motivated and proactive, able to prioritize tasks and manage cases to completion.

• Proficient in written and spoken English at a fluent or advanced level.

• Ability to communicate technical risks and remediation strategies to distributed teams and senior stakeholders.

• Comfortable working in dynamic and uncertain environments, collaborating with development, QA, infrastructure, operations, and security teams.

• Prior hands-on experience as a software developer, especially in mentoring other developers on code remediation.

• Familiarity with architectural patterns like MVC, microservices, and event-driven architecture.

• Experience with Agile methodologies, including XP, Scrum, or Kanban.

• Knowledge of Test-Driven Development (TDD) and CI/CD practices.

• Understanding of cloud architecture and services, particularly AWS.

• Exposure to code reviews, penetration testing concepts, Burp Suite, Metasploit, fuzzing, or Jenkins.

• Experience in using or supporting AI-based capabilities in engineering or security services.

• Confidence in voicing opinions, suggesting improvements, and contributing within an open team setting.

🏝️ Benefits

• Remote work arrangement.

• Full-time employment.