Senior Information Security Analyst

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Implement Secure Software Development Life Cycle (SDLC) practices.

• Conduct vulnerability assessments for web applications, APIs, and microservices.

• Assist development teams in embracing DevSecOps methodologies.

• Define security specifications for new systems and projects.

• Monitor the remediation of vulnerabilities identified by SAST, DAST, SCA, and penetration testing tools.

• Apply security controls and best practices based on the OWASP Top 10 and ASVS frameworks.

• Implement and oversee security controls in AWS, Azure, or GCP environments.

• Evaluate the security configurations and compliance of cloud environments.

• Manage identity and access management (IAM) processes.

• Conduct risk assessments and harden workloads.

• Support secure cloud architecture initiatives.

• Monitor, investigate, and respond to security incidents.

• Execute threat hunting and analyze indicators of compromise.

• Administer and enhance tools such as SIEM, EDR/XDR, WAF, IDS/IPS, and Threat Intelligence platforms.

• Develop use cases, correlation rules, and monitoring dashboards.

• Lead incident investigations and forensic analyses as required.

• Create scripts and automations for incident response.

• Automate processes for vulnerability management and compliance.

• Integrate security tool APIs to boost operational efficiency.

• Support Security Engineering projects.

⛳️ Requirements

• Bachelor’s degree in Information Security, Computer Science, Information Systems, Computer Engineering, or a related discipline.

• Strong senior-level experience in Information Security.

• Practical experience with Application Security (AppSec) and DevSecOps.

• Familiarity with the OWASP Top 10, SAST, DAST, and penetration testing methodologies.

• Experience with cloud platforms, preferably Microsoft Azure.

• Proficient with SIEM, EDR/XDR, WAF, IDS/IPS, DLP, and IAM solutions.

• Understanding of the MITRE ATT&CK, NIST, and CIS Controls frameworks.

• Experience in incident response and threat hunting activities.

• Knowledge of TCP/IP, DNS, HTTP/HTTPS, and application architecture.

• Skills in programming and automation using Python, PowerShell, or Bash.

• Analytical and investigative mindset.

• Excellent communication skills with both technical and multidisciplinary teams.

• Operational and strategic comprehension of security principles.

• Proactive and self-directed attitude.

• Ability to influence and collaborate with various teams across the organization.

• Preferred certifications include Security+, CySA+, CEH, AZ-500, or AWS Certified Security – Specialty.

• Knowledge of Infrastructure as Code (IaC) security using Terraform.

• Experience in telecommunications and Internet service provider environments.

• Familiarity with containers, Kubernetes, and API security practices.

🏝️ Benefits

• Transportation voucher.

• Meal and/or food allowance.

• Gympass.

• Day off.

• Partnership benefits.

• Continuous learning opportunities.

• Support for professional development.