Senior Security – QA Lead

This is a fully remote position, open to applicants in Brazil.

📋 Description

• Design and oversee adversarial security testing for the deterministic decision-making process.

• Attempt to bypass default-DENY, escalate privileges, or cross tenant boundaries, demonstrating the integrity of those boundaries.

• Evaluate multi-tenant isolation and owner-versus-customer scoping through the platform’s roster subsystem utilizing genuine tenant-scoped identities.

• Confirm the tamper-resistance of the hash-chained audit trail, ensuring append-only behavior, hash-chain linkage, and detection of attempted alterations.

• Validate authentication and authorization processes across both tenant and operator roles.

• Review and enhance the existing per-module freeze-audit self-tests.

• Guarantee that every governance rule navigates through the live intake path to a legitimate engine record.

• Prioritize findings by severity and supply clear reproduction steps in GitHub Issues.

• Maintain visibility of findings in alignment with the freeze-audit CI gate.

• Uphold the merge gate: no changes are accepted unless the freeze-audit CI is successful.

• Collaborate with the client on architectural approval for governance-core modifications.

• Report to the Ubiminds Engagement Manager.

• Deliver a comprehensive documented adversarial test suite, independent audit-chain verification, severity-ranked findings, and a streamlined green-CI defect flow within the first 12 weeks.

⛳️ Requirements

• Solid background in security testing, including penetration testing, authorization/access-control testing, or security QA for systems where boundary failures pose the primary risk.

• Hands-on experience with Python and comfort in navigating a real codebase to create tests against it.

• Familiarity with multi-tenant SaaS and a practical understanding of tenant isolation failure modes.

• Practical knowledge of cryptographic audit trails/hash chaining and methods for demonstrating tamper-evidence.

• Experience with Docker and CI workflows, including GitHub Actions or similar tools.

• Capability to work in alignment with a green-CI merge gate.

• Proficiency in Postgres for validating durable state and data persistence.

• Clear written communication in English.

• Strong capacity to generate rigorous, reproducible defect reports.

• Experience in testing policy engines, authorization systems, or agentic-AI guardrails.

• Familiarity with SOC 2 controls and evidence expectations.

• Knowledge of Render or similar container hosting solutions.

• Experience in a regulated or safety-critical environment.

🏝️ Benefits

• Integrated into a product-oriented company and regarded as a full-time team member.

• Comprehensive back-office support: career guidance, HR assistance, and concierge services.

• Remote-first work policy.

• Company-issued MacBook (no BYOD policy).

• Opportunities for tech talks, chapter meetings, and access to a robust community of top engineers.

• Complimentary English lessons with a native speaker.

• Referral bonuses for recommending new Ubiminders.

• Access to the Florianópolis headquarters, featuring snacks, massages, beverages, and games.