Senior QA / Test Engineer - 12 Weeks

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Design and oversee adversarial security testing for the deterministic decision path.

• Attempt to bypass default-DENY protections, escalate privileges, or breach tenant boundaries.

• Test multi-tenant isolation and the distinctions between owner and customer scopes using tenant-scoped identities.

• Confirm the tamper-resistance of the hash-chained audit trail, which includes append-only functionality, hash-chain linkage, and mutation detection.

• Validate authentication and authorization processes across tenant and operator roles.

• Review and enhance per-module freeze-audit self-tests.

• Ensure governance rules are resolved through the live intake path to a genuine engine record.

• Prioritize findings by severity and supply reproduction steps in GitHub Issues.

• Maintain findings in alignment with the freeze-audit CI gate.

• Enforce the merge gate that requires a green freeze-audit CI.

• Collaborate with the client on architectural approval for governance-core modifications.

• Deliver a comprehensive adversarial test suite, independent audit-chain verification, severity-ranked findings, and a streamlined defect flow within the initial 12 weeks.

⛳️ Requirements

• Strong background in security testing, including penetration testing, authorization/access-control testing, or security QA.

• Practical experience with Python and the ability to read a real codebase for test design.

• Familiarity with multi-tenant SaaS and the potential failure modes of tenant isolation.

• Solid understanding of cryptographic audit trails, hash chaining, and tamper-evidence principles.

• Experience with Docker and CI-based workflows, including GitHub Actions or similar tools.

• Capability to operate against a green-CI merge gate.

• Proficiency with Postgres for validating durable state and persistence.

• Excellent written English skills.

• Strong aptitude for producing thorough, reproducible defect reports.

• Experience in testing policy engines, authorization systems, or agentic-AI guardrails.

• Familiarity with SOC 2 controls and evidence requirements.

• Knowledge of Render or equivalent container hosting solutions.

• Background in a regulated or safety-critical environment.

🏝️ Benefits

• Integrated into a product-based company and treated as a full-time team member.

• Comprehensive back-office support, including career guidance, HR, and concierge services.

• Remote-first working policy.

• Company-issued MacBook (no BYOD allowed).

• Opportunities for tech talks, chapter meetings, and engagement with a strong community of top engineers.

• Complimentary English lessons with a native speaker.

• Referral bonuses for recommending new Ubiminders.

• Access to the Florianópolis HQ, complete with snacks, massages, beverages, and games.