Senior Digital Security Specialist – Offensive and Defensive Security

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Design and implement black-box, gray-box, and white-box penetration tests for web applications, APIs, networks, servers, and cloud environments, ensuring formal scope and authorization are established.

• Mimic real-world attack scenarios, including the exploitation of vulnerabilities, privilege escalation, lateral movement, and chaining of vulnerabilities.

• Carry out vulnerability assessments and evaluate insecure configurations, manually validating findings from automated tools.

• Conduct security-focused code reviews as required.

• Keep abreast of the latest attack techniques, CVEs, and emerging threat trends.

• Suggest technical solutions and determine root causes of security issues.

• Advise on enhancements to architecture, hardening measures, configuration best practices, and compensating controls.

• Assess risks based on severity and impact utilizing CVSS, OWASP, and MITRE ATT&CK frameworks.

• Assist development, infrastructure, and cloud teams in applying fixes and revalidating results.

• Contribute to secure development practices and vulnerability management efforts.

• Generate technical reports and executive summaries containing evidence, reproduction steps, risk ratings, and remediation strategies.

• Present findings and recommendations to both technical and non-technical stakeholders.

• Read and create technical documentation in English.

⛳️ Requirements

• Demonstrated experience in penetration testing and offensive security across various domains (web/API, infrastructure, networks, and cloud).

• Familiarity with securing AWS environments.

• Strong understanding of OWASP Top 10, OWASP ASVS, PTES, MITRE ATT&CK, and CVSS.

• Comprehensive knowledge of networking, Linux and Windows operating systems, Active Directory, authentication methods, and cryptography.

• Proficient with tools such as Burp Suite, Nmap, Metasploit, and enumeration and post-exploitation utilities.

• Capability to automate tasks and create custom tools or scripts using Python or Bash.

• Experience in proposing and overseeing the implementation of fixes and hardening measures.

• Excellent technical writing and communication skills.

• Technical proficiency in English.

• Preferred: experience with Azure, GCP, and/or OCI.

• Preferred: certifications including OSCP, OSEP, OSWE, GPEN, GWAPT, CISSP, AWS Certified Security – Specialty, Microsoft AZ-500, Google Professional Cloud Security Engineer, Oracle Cloud Infrastructure Security Professional, or CCSP.

• Preferred: involvement in Bug Bounty programs, CTFs, or responsible vulnerability disclosure (published CVEs).

• Preferred: experience with Threat Modeling and security within CI/CD pipelines (DevSecOps).

🏝️ Benefits

• Opportunity for remote work.

• Role focused on individual contributions.