Vivo (Telefônica Brasil)

DevOps Engineer

• Act as the technical reference for Application Security, with a focus on threat modeling and security by design
• Lead Threat Modeling sessions (e.g., STRIDE) for new initiatives, architectural changes and integrations, identifying risks early
• Define and evolve Secure Design practices, ensuring adherence to frameworks such as OWASP ASVS, SAMM and Top 10
• Work closely with development and software architecture teams to incorporate security from the outset (shift-left)
• Lead security initiatives related to the use of Artificial Intelligence throughout the development lifecycle
• Identify and mitigate risks in applications that use AI (e.g., prompt injection, data leakage, model abuse)
• Support the safe use of AI-based tools (e.g., copilots, code generation tools)
• Apply best practices based on emerging guidance such as OWASP Top 10 for LLM Applications
• Explore the use of AI to scale AppSec activities (e.g., vulnerability triage, automated analysis)
• Define security requirements and standards for applications, APIs and services
• Ensure security requirements are clear, prioritized and measurable
• Contribute to defining controls for API security (authentication, authorization, rate limiting, etc.)
• Support contextualized vulnerability management
• Prioritize risks considering technical and business impact
• Work with teams to define remediation strategies
• Contribute to the evolution of the Application Security maturity model
• Structure and evolve practices aligned with OWASP SAMM
• Create and maintain guidelines, standards and playbooks
• Promote a security culture
• Strengthen security awareness across the organization
• Act as the technical Application Security reference for development teams
• Lead enablement initiatives (workshops, trainings and dissemination of best practices)

Senior AppSec / DevSecOps