Creditas

Security Engineer

• Implement security controls across the development lifecycle, from design to deployment, as part of the AppSec program.
• Conduct Threat Modeling sessions with product squads to identify architectural risks before implementation.
• Manage and optimize SAST, DAST and SCA tools, prioritizing findings based on real business risk rather than only isolated technical severity.
• Maintain the Security Champions program, empowering developers to be the first line of defense.
• Validate the architecture of new projects and API integrations, ensuring compliance with OWASP ASVS and internal standards.
• Manage the vulnerability remediation workflow with engineering, addressing root causes rather than just symptoms.
• Translate technical risks into business impact for Product Owners and stakeholders. Automate security validations in CI/CD pipelines and maintain metrics such as remediation SLAs and defect density.

Security Engineer, AppSec

• Lead GRC automation: Transform compliance requirements and policies into automated controls (Compliance as Code), reducing reliance on manual evidence collection.
• Implement AI in governance: Explore and apply AI solutions to optimize GRC processes, such as risk analysis, vulnerability mapping, and responses to security questionnaires.
• Develop and maintain technical controls: Work closely with Engineering teams to ensure frameworks such as ISO 27001, NIST, and SOC 2 are implemented via automation in the CI/CD pipeline.
• Manage risks with a data-driven approach: Conduct security risk assessments using real data and telemetry, moving beyond subjective analysis.
• Build automated indicators: Create technical and operational security dashboards that reflect compliance in real time, using APIs and data tools.
• Technical interface with audit: Orchestrate internal and external audit deliverables through systematized processes, ensuring findings/non-conformities are treated as technical debt.
• Support Privacy and Business: Act as a technical consultant to Privacy and Business areas, ensuring new projects and vendors incorporate security controls by design.

Security Engineer, AppSec

Senior Security Engineer – GRC