Security Engineer – DevSecOps, AppSec

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Implement and oversee SAST, DAST, and SCA tools within the CI/CD pipeline (Bitbucket/GitHub/GitLab).

• Establish, manage, and enhance Secrets Manager and Vault functionalities.

• Execute continuous secret scanning across repositories and lead the remediation efforts with development teams.

• Carry out security-focused code reviews for essential features, including authentication, authorization, external integrations, and the handling of sensitive data.

• Strengthen infrastructure security, including Terraform state, IAM policies, AWS configurations, and Security Groups.

• Assist in addressing technical findings identified by security analysis tools, external penetration tests, and internal scans.

• Develop and spearhead the Security Champions program by identifying liaisons within development squads and organizing ongoing training sessions.

• Perform threat modeling for new features and critical integrations in collaboration with product and engineering teams.

• Define and document security requirements throughout the Software Development Life Cycle (SDLC), from design to deployment.

• Evaluate the security of both internal and external APIs, partner integrations, and authentication processes.

⛳️ Requirements

• Hands-on experience with CI/CD pipelines and integrating security tools (SAST, SCA, and secret scanning) into the development workflow.

• Strong knowledge of AWS, including IAM, S3, Lambda, Security Groups, VPC, KMS, and best practices in cloud security.

• Proficiency in infrastructure as code (Terraform), with the capability to identify and remediate security vulnerabilities in IaC.

• Understanding of the OWASP Top 10 and OWASP API Security Top 10, with the ability to apply these frameworks to code and architecture evaluations.

• Capability to write scripts and automate processes for analysis and remediation using Python or Bash.

• Ability to read and interpret code in at least one programming language utilized by the product.

• Strong critical thinking and risk analysis skills.

• Proactive attitude, initiative, and the ability to foresee needs.

• Excellent interpersonal communication skills when collaborating with development teams.

• Technical independence and self-sufficiency.

• Teamwork and collaborative spirit.

• Ability to clearly explain concepts and facilitate knowledge transfer.

• Strong sense of ownership and results orientation.

• Experience with Bitbucket is a plus.

• Practical experience in managing secrets with HashiCorp Vault and/or AWS Secrets Manager is a plus.

• Familiarity with DAST tools (OWASP ZAP, Burp Suite) integrated into pipelines is a plus.

• Knowledge of security for Docker containers and image repositories is a plus.

• Experience applying CIS Benchmarks to AWS workloads is a plus.

• Basic understanding of mobile security or binary analysis is a plus.

• Familiarity with cloud posture management tools (Wiz, Prisma Cloud, AWS Security Hub, GuardDuty) is a plus.

• Experience in conducting security reviews of serverless architectures (Lambda, API Gateway) is a plus.

• Preferred certifications include: AWS Certified Solutions Architect – Associate; AWS Certified Solutions Architect – Professional; AWS Certified Security – Specialty; Certified DevSecOps Professional (CDP) – Practical DevSecOps; HashiCorp Vault Associate.

🏝️ Benefits

• Contractor arrangement (PJ) with 30 days of paid time off.

• Health and dental insurance with premiums fully covered by Saipos (copayments apply to consultations and exams).

• Life insurance coverage.

• Day off during the birthday month.

• Access to Wellhub services.

• Complete equipment package provided.

• Daily transportation allowance of BRL 22 for on-site work.

• Home office allowance of BRL 180.00 for professionals working remotely at least three days per week.

• Extended maternity and paternity leave benefits.