Security Engineer (DevSecOps / AppSec)

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (DevSecOps / AppSec) based in Brazil.

This is an opportunity to strengthen application and cloud security within a fast-growing technology environment. You will embed security practices directly into the software development lifecycle, from design through deployment. The role combines DevSecOps, Application Security, cloud security, infrastructure hardening, and risk management. You will work closely with engineering and product teams to identify vulnerabilities and build secure solutions proactively. A key part of the position will be developing security automation and empowering developers through a Security Champions program. You will also help shape security standards for APIs, integrations, authentication, sensitive data, and critical features. The role offers significant technical autonomy and the opportunity to influence security practices across the organization.

• Implement and maintain SAST, SCA, secret-scanning, and other security controls within CI/CD pipelines across platforms such as Bitbucket, GitHub, and GitLab.
• Operate and continuously improve secrets-management solutions, including HashiCorp Vault and AWS Secrets Manager.
• Monitor repositories for exposed secrets and coordinate remediation with development teams.
• Perform security-focused code reviews for critical features involving authentication, authorization, external integrations, and sensitive data.
• Harden AWS infrastructure and infrastructure-as-code, including IAM policies, Terraform state, VPCs, Security Groups, KMS, and related configurations.
• Support remediation of vulnerabilities and findings identified through security tools, penetration tests, and internal assessments.
• Build and lead a Security Champions program by identifying security focal points within engineering squads and developing continuous enablement initiatives.
• Conduct threat modeling for new features, integrations, and critical architectural changes in partnership with product and engineering teams.
• Define, document, and promote security requirements throughout the SDLC, from architecture and design through deployment.
• Assess the security of internal and external APIs, partner integrations, authentication flows, and other critical application components.
• Develop scripts and automation to support security analysis, vulnerability remediation, and operational efficiency.
• Collaborate with engineering teams to strengthen security awareness, adoption of secure coding practices, and continuous risk reduction.

Requirements

• Practical experience with CI/CD pipelines and integrating security tooling such as SAST, SCA, and secret scanning into development workflows.
• Solid knowledge of AWS security services and practices, including IAM, S3, Lambda, Security Groups, VPC, KMS, and cloud security principles.
• Hands-on experience with Terraform and the ability to identify and remediate security risks in infrastructure-as-code.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10, with the ability to apply these principles to code and architecture reviews.
• Ability to develop scripts and automations for security analysis and remediation using Python, Bash, or similar technologies.
• Ability to read and understand application code in at least one programming language used within a software product.
• Strong critical-thinking and risk-analysis skills, with the ability to assess vulnerabilities based on business and technical impact.
• Proactive and autonomous approach, with the ability to anticipate risks, take ownership, and drive security improvements through completion.
• Strong interpersonal and communication skills for working closely with software development and engineering teams.
• Collaborative mindset and ability to operate effectively across technical and cross-functional teams.
• Strong ability to explain security concepts clearly and transfer knowledge to developers and other stakeholders.
• Experience with Bitbucket is a plus.
• Practical experience with HashiCorp Vault and/or AWS Secrets Manager is desirable.
• Familiarity with DAST tools such as OWASP ZAP or Burp Suite and their integration into CI/CD pipelines is desirable.
• Knowledge of Docker security and container image repositories is a plus.
• Experience applying CIS Benchmarks to AWS workloads is desirable.
• Familiarity with cloud security posture management tools such as Wiz, Prisma Cloud, AWS Security Hub, or GuardDuty is a plus.
• Experience reviewing serverless architectures involving Lambda and API Gateway is desirable.
• Knowledge of mobile security or binary analysis is considered an additional advantage.
• Relevant certifications such as AWS Certified Solutions Architect, AWS Certified Security – Specialty, Certified DevSecOps Professional, or HashiCorp Vault Associate are desirable.

Benefits

• Remote work model.
• PJ contract with 30 days of paid rest.
• Health and dental insurance with the monthly premium fully covered, subject to copayments for consultations and exams.
• Life insurance.
• Day off during your birthday month.
• Wellhub membership.
• Complete equipment kit for work.
• Daily transportation allowance of R$22 when working on-site.
• Home-office allowance of R$180 for professionals working remotely at least three days per week.
• Extended maternity and paternity leave.
• Opportunity to work on security initiatives with broad technical impact across cloud infrastructure, applications, and development processes.
• Inclusive opportunities, including consideration for people with disabilities.