Senior Red Team Analyst

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Design, develop, and enhance an autonomous penetration testing agent that is incorporated into the staging environment and CI/CD pipeline.

• Address the OWASP Top 10, OWASP API Security Top 10, business logic vulnerabilities, authentication, authorization, IDOR/BOLA, and cloud misconfigurations.

• Establish permitted scope, action boundaries, human approval criteria for destructive testing, and maintain audit trails.

• Evaluate the agent’s false-positive rate, coverage, and vulnerabilities discovered in comparison to manual penetration testing.

• Embed findings into the engineering workflow with tickets, severity ratings, reproducible evidence, and remediation recommendations.

• Assist in threat modeling for new features and convert scenarios into test cases.

• Execute manual penetration tests on web applications, APIs, mobile applications, and AWS infrastructure.

• Conduct ad hoc testing prior to releases, create technical and executive reports, validate fixes, and monitor remediation efforts.

• Plan and carry out red team and purple team exercises alongside the Blue Team.

• Simulate identity and SSO compromise, exploitation of Pix payment flows, lateral movement in AWS, and social engineering tactics.

• Document the techniques utilized and assess the Blue Team’s detection and response capabilities.

• Act as a technical point of reference for another Red Team professional by reviewing findings and offering mentorship.

• Provide evidence for audits and regulatory compliance, including BCB Resolution 85.

• Collaborate with the Red Team, Blue Team, and engineering teams to address vulnerabilities.

⛳️ Requirements

• Over 5 years of experience in offensive security, particularly in comprehensive web application and API penetration testing.

• Strong understanding of the OWASP Top 10, OWASP API Security Top 10, as well as authentication, authorization, and business logic testing.

• Practical experience with Burp Suite and other offensive security tools, avoiding reliance solely on scanners.

• Proficient in Python (or Go/TypeScript), with demonstrated experience in developing custom tools—not merely scripts.

• Familiarity with building LLMs, including agents, tool usage, structured prompts, or model API integrations.

• Offensive security expertise in AWS, covering IAM, privilege escalation, and exposed services.

• Experience with integrating security practices into CI/CD pipelines.

• Strong report-writing abilities tailored for both engineering teams and leadership.

• Excellent ethical judgment and discipline in following scope and rules of engagement.

• Relevant offensive security certifications such as OSCP, OSWE, OSEP, BSCP, eWPTX, or equivalent.

• Background in fintech, payment systems, or Pix.

• Contributions to open-source security projects, published CVEs, or participation in bug bounty programs.

• Experience with red team or purple team exercises in organizations with a mature SOC.

• Proficiency in mobile application testing (Android and iOS).

• Understanding of AI agent evaluation, including evaluations, false-positive measurement, and securing the agent itself (prompt injection and tool abuse).

• Experience with infrastructure as code (Terraform) and containerization.

🏝️ Benefits

• PJ contractor arrangement.

• Competitive compensation.

• Health insurance covering 100% of the employee and 75% of the first dependent.

• Day off during birthday month.

• Monthly discount coupons for stores that accept Pix Parcelado.

• Fully remote work.