Offensive Security Specialist

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Act as the technical authority for RecargaPay’s Offensive Security team.

• Establish the protocols for safeguarding applications, financial products, and AI assets.

• Formulate the technical strategy for AppSec and offensive testing, covering methodology, scope, risk-based prioritization, and performance metrics.

• Oversee the application vulnerability management program, ensuring timely remediation of critical issues and negotiating priorities with engineering leadership.

• Direct threat modeling and architecture assessments for key projects, including Pix, lending, cards, and AI agents.

• Plan and execute intricate penetration tests on web applications and APIs, concentrating on business logic and attack sequences.

• Transform recurring security findings into controls and regression tests.

• Define the parameters for external penetration tests and the annual PCI DSS assessment.

• Serve as the technical authority for evaluating external findings, including bug bounty submissions, consulting projects, and external reports.

• Drive the advancement of automation and AI agents to enhance code review, triage, and security testing.

• Represent the team in audits, collaborating with partner teams and leadership, translating technical risks into business strategies.

• Function as the technical authority for the entire team and act as the technical deputy to the manager, mentoring senior and mid-level professionals.

⛳️ Requirements

• Proven experience providing technical leadership for an Application Security or offensive testing initiative within a product company.

• Comprehensive experience managing vulnerabilities in collaboration with engineering, prioritizing based on business risk, and reporting metrics to leadership.

• In-depth expertise in web application and API penetration testing (REST/GraphQL), focusing on business logic, authentication, authorization (IDOR/BOLA), and attack sequences.

• Security code review experience in at least one backend programming language: Java, Kotlin, Go, Python, or Node.js.

• Experience with architecture-level threat modeling.

• Background in developing automation and custom tools using Python or Go.

• Practical application of AI (LLMs or agents) in security tasks such as triage, code review, or testing.

• Degree in technology or a related discipline, or equivalent professional experience.

• Proficient technical English for interpreting documentation, advisories, and research.

• Nice to have: Familiarity with LLM, agent, and MCP security (prompt injection, tool abuse, and data exposure).

• Nice to have: Experience in mobile penetration testing for Android and iOS (Frida, objection, Burp Suite).

• Nice to have: Background in a regulated financial sector (PCI DSS, LGPD, BACEN) and familiarity with audits.

• Nice to have: Certifications like OSWE, BSCP, OSCP, or equivalent, alongside contributions such as CVEs, research, or conference presentations.

🏝️ Benefits

• Competitive, market-aligned salary.

• Remote work — wherever you are, you are part of the team!

• Monthly home office allowance provided through the RecargaPay app.

• Health and dental insurance with no copayment required.

• Life insurance coverage.

• Flexible meal allowance through Flash.

• TotalPass to support your health and wellness.

• Commitment to Diversity & Inclusion at RecargaPay: the freedom to be yourself in an inclusive environment that embraces diverse perspectives and experiences.

• Potential consideration for other opportunities within the RecargaPay Group using your résumé, in compliance with Brazil’s LGPD.