Senior QA / Test Engineer – 12 Weeks

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Design and oversee adversarial security testing for the deterministic decision path.

• Attempt to bypass default-DENY, escalate privileges, or cross tenant boundaries.

• Evaluate multi-tenant isolation along with owner-versus-customer scoping using tenant-scoped identities.

• Confirm the tamper-resistance of the hash-chained audit trail, ensuring append-only behavior, hash-chain linkage, and mutation detection.

• Validate authentication and authorization processes across tenant and operator roles.

• Review and enhance per-module freeze-audit self-tests.

• Ensure governance rules are resolved through the live intake path to an actual engine record.

• Prioritize findings by severity and provide reproduction steps in GitHub Issues.

• Align findings with the freeze-audit CI gate.

• Maintain the merge gate requiring a green freeze-audit CI.

• Collaborate with the client on architectural sign-off for governance-core changes.

• Produce a documented adversarial test suite, independent audit-chain verification, a severity-ranked findings report, and a streamlined defect flow through freeze-audit CI.

⛳️ Requirements

• Strong background in security testing, including penetration testing, authorization/access control testing, or security QA.

• Hands-on experience with Python and the ability to read a real codebase for test design.

• Familiarity with multi-tenant SaaS and failure modes of tenant isolation.

• Practical knowledge of cryptographic audit trails, hash chaining, and tamper-evidence.

• Experience with Docker and CI workflows, such as GitHub Actions or equivalent.

• Capability to work with a green-CI merge gate.

• Proficient in Postgres for validating durable state and persistence.

• Strong written English skills.

• Ability to create thorough, reproducible defect reports.

• Nice to have: experience in testing policy engines, authorization systems, or agentic-AI guardrails.

• Nice to have: exposure to SOC 2 controls and evidence expectations.

• Nice to have: familiarity with Render or similar container hosting platforms.

• Nice to have: background in a regulated or safety-critical domain.

🏝️ Benefits

• Comprehensive back-office support, including career guidance, HR, and concierge services.

• Remote-first work policy.

• Company-provided MacBook (no BYOD policy).

• Participation in tech talks, chapter meetings, and access to a vibrant community of top engineers.

• Free English lessons with a native speaker.

• Referral bonus for introducing new Ubiminders.

• Access to the Florianópolis HQ, featuring snacks, massages, drinks, and games.