Senior Analyst – Offensive Security

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Safeguard RecargaPay’s applications and financial products comprehensively, from the design of features to the resolution of vulnerabilities.

• Act as the cornerstone of the team’s Application Security and manage the vulnerability lifecycle in collaboration with engineering teams.

• Assess vulnerabilities based on business risk, taking into account potential financial impacts and exposure of customer data.

• Coordinate remediation timelines with engineering teams, while tracking and verifying the implementation of fixes.

• Lead threat modeling and design assessments for essential features such as Pix, credit, cards, and onboarding prior to the commencement of development.

• Execute security code reviews and enhance SAST and SCA controls within the CI/CD pipeline.

• Plan and carry out penetration tests across web applications, APIs, and mobile applications, focusing on business logic, authentication, and authorization.

• Convert penetration testing results into actionable fixes and regression tests.

• Establish the technical parameters for external penetration tests and the annual PCI DSS evaluation.

• Evaluate findings from bug bounty programs, consulting agencies, and external reports, confirming exploitability, actual severity, and ownership.

• Assist the Security Champions program and provide guidance to engineering teams.

• Develop and utilize automation and AI agents to enhance the scalability of code reviews, triage, and security testing.

• Serve as a technical reference and mentor for the team’s mid-level analysts.

⛳️ Requirements

• Extensive experience in Application Security within a product organization, including comprehensive vulnerability management with development teams and prioritization based on business risk.

• Proven experience in conducting penetration tests on web applications and APIs (REST/GraphQL), focusing on business logic, authentication, and authorization (IDOR/BOLA).

• Experience in conducting security code reviews in at least one backend programming language (Java, Kotlin, Go, Python, or Node.js).

• Familiarity with threat modeling and SAST and SCA tools throughout the software development lifecycle.

• Proficient in developing scripts and automation using Python or Go.

• Proficient in technical English for interpreting documentation, advisories, and research materials.

• A degree in technology or a related discipline, or equivalent professional experience.

• Preferred: Experience with Android and iOS mobile penetration testing tools (Frida, Objection, Burp Suite).

• Preferred: Knowledge of LLM, agent, and MCP security, or experience utilizing AI agents within security workflows.

• Preferred: Background in a regulated financial setting (PCI DSS, LGPD, BACEN).

• Preferred: Certifications such as OSWE, BSCP, OSCP, or similar.

• Ownership: Committed to following vulnerabilities through to remediation rather than stopping at reporting.

• Risk judgment: Capable of differentiating exploitable issues relevant to the business from non-critical noise without exaggerating severity.

• Engineering influence: Ability to persuade teams with evidence and negotiate timelines and mitigations when immediate remediation is unfeasible.

• Two-level communication: Skillfully communicates impact to leadership and remediation steps to developers.

• Mentorship: Elevates the technical capabilities of mid-level analysts through reviews, collaboration, and constructive feedback.

• AI-first mindset: Leverages AI to enhance productivity while applying sound judgment to minimize false positives.

• Upholds ethics and discretion when using privileged access and handling sensitive information.

🏝️ Benefits

• Competitive salary that aligns with market standards.

• Flexibility to work remotely — no matter where you are, you’re part of the team!

• Monthly home office allowance provided through the RecargaPay app.

• Comprehensive health and dental insurance with no copayment required.

• Life insurance coverage.

• Flexible meal allowance (via Flash).

• TotalPass to support your overall health and well-being.

• An inclusive work environment that encourages you to be your authentic self.

• Opportunity for consideration for additional roles within the RecargaPay Group based on data collected during the hiring process.