Security Engineer

• Assess technical vulnerabilities and propose solutions to improve the security of our platform, working in our stack (Ruby, Go, and PHP) and developing security fixes on AWS/Lambda.
• Quickly assess development queue demands, reducing the AppSec bottleneck and unblocking Engineering deliveries.
• Actively propose and implement fixes in code, going beyond merely reporting findings.
• Conduct threat modeling and apply secure-by-design principles to product initiatives.
• Create guardrails, tooling, and automations that make the secure path the default for Engineering teams.
• Integrate and tune security tools in the CI/CD pipeline (SAST, SCA, and secret scanning), keeping noise and false positives low.

AppSec Specialist, Application Security

• **Strategic Risk Partnership:** Map, identify, and model cyber and digital-origin corporate risk scenarios (such as data leaks, digital extortion, cyberattacks, and downtime) across the company's ecosystem, translating technical data into clear business-impact insights.
• **Audit Orchestration:** Serve as the primary focal point and facilitator for internal and external audits. You will be the link between auditors and technology teams, constructively challenging findings, ensuring clarity of control objectives and validating that technical responses are robust.
• **Maturity Advancement (NIST & CIS):** Conduct periodic assessments and manage the roadmap for Information Security maturity using the CIS Controls and NIST CSF frameworks to evaluate and raise the effectiveness of our technical controls.
• **Action Plan Assurance (Remediation):** Support and guide technical teams in building effective action plans (APs), ensuring that proposed fixes address root causes and truly mitigate the issues identified in audits.
• **PCI DSS Support:** Support the management, design, and effectiveness testing of controls related to PCI DSS certification, ensuring continuous compliance and the security of our transactional operations.
• **Technological Resilience:** Actively collaborate in mapping discontinuity scenarios for critical environments, supporting decision-making that ensures business resilience and continuity based on technological criticality.
• **Metrics and Awareness:** Operate GRC tools, review metrics, and create intelligent KRIs (Key Risk Indicators) to monitor the materialization of risks. In addition, you will support the dissemination of a risk and security culture across the company.

Risk Specialist I – Information Security

• Foco em testes de intrusão e segurança de aplicações web, com ênfase em integrações estratégicas e validação de segurança em parceiros de negócio do ecossistema Omie.
• Pentest de APIs: Testes de segurança em endpoints, análise de fluxos de autenticação (OAuth, JWT) e integrações de terceiros.
• Desenvolvimento Seguro: Revisão de código e integração de ferramentas SAST/DAST em esteiras de CI/CD.
• Relatórios de Vulnerabilidade: Redação técnica para desenvolvedores e relatórios executivos de risco para stakeholders.

Analista de Segurança da Informação Pleno – Pentest

• Assess architectures, solutions, integrations, data flows and technical designs from a security perspective.
• Define recommendations for controls, standards, minimum requirements and architectural best practices.
• Support squads, strategic projects and initiatives in adopting security by design.
• Participate in technical forums, guilds and corporate architecture discussions.
• Align security requirements across privacy, continuity, identity, applications, cloud and infrastructure.
• Support decisions on technologies, standards, exceptions, residual risks and mitigating alternatives.
• Contribute to policies, technical standards, reference architectures and control catalogs.

Information Security Architect III

• Technical owner for the information security operations platform, responsible for the architecture, strategy, and sustaining controls for detection, incident response, vulnerability management, identity management, and perimeter governance.
• Primary technical reference for the area, contributing to process maturity and the technical development of the team.
• Architect, deploy, and direct the maintenance of an open-source-based SIEM platform, including data collection, normalization, event correlation, processing pipelines, and retention policies.
• Develop and maintain detection use cases aligned with the MITRE ATT&CK framework, with continuous tuning to reduce false positives and increase detection effectiveness.
• Strategically lead the corporate Vulnerability Management program, including risk-based prioritization, coordination of remediation with technology teams, and monitoring executive-level indicators.
• Define and govern Identity and Access Management (IAM) processes: identity lifecycle, segregation of duties, RBAC, MFA, and periodic access reviews.
• Govern policies and rules for Next-Generation Firewalls (NGFW): network segmentation, periodic rule reviews, and hardening.
• Provide technical leadership for response to critical security incidents, supporting containment, forensic analysis, and coordination of remediation activities.
• Implement and monitor hardening of environments based on recognized industry benchmarks (CIS Benchmarks).
• Develop automations and integrations using tools and scripting languages to optimize team operations.
• Prepare and maintain high-complexity technical documentation, standard operating procedures, security policies, and reference architectures.
• Act as a mentor to team analysts, promoting knowledge transfer, technical culture, and operational continuity.

Information Security Specialist

• We are looking for someone passionate about technology and information security, with a technical, investigative profile and a strong desire to learn.
• This opportunity is ideal for students interested in working in a **Blue Team** environment, with exposure to both offensive and defensive security topics, as well as activities involving **Linux, development, automation and environment monitoring**.
• We seek a curious person who likes to understand how things work, get hands-on, study security, and develop technical solutions.
• **Main responsibilities**
• Support activities related to **Information Security**;
• Assist with security analyses in Linux environments;
• Support investigations, troubleshooting and log analysis;
• Assist with activities related to **security monitoring (SOC)**;
• Support **offensive security** initiatives, such as research, validation and security testing;
• Develop or support automations, scripts and technical improvements;
• Assist with integrations and analyses in security tools;
• Participate in studies, tests and continuous improvements of the environments.

Intern, Blue Team

• Atuar na definição, implantação e evolução de controles de Segurança da Informação, assegurando aderência às políticas corporativas, aos requisitos regulatórios e aos frameworks de mercado, com foco em gestão de riscos, proteção de dados, continuidade operacional e redução da superfície de exposição.
• Conduzir análises de risco cibernético em sistemas, aplicações, integrações, fornecedores, projetos e mudanças relevantes, propondo planos de tratamento, controles compensatórios, critérios de priorização e indicadores de acompanhamento para suportar decisões técnicas e executivas.
• Apoiar a estruturação, manutenção e evolução do Sistema de Gestão de Segurança da Informação (SGSI), incluindo políticas, normas, procedimentos, evidências, trilhas de auditoria, controles e preparação para auditorias internas, externas e iniciativas de readiness regulatório e corporativo, inclusive em contextos de abertura de capital/IPO.
• Liderar tecnicamente iniciativas de desenvolvimento seguro e DevSecOps, estabelecendo padrões de secure by design, secure by default, revisão de arquitetura, requisitos de segurança para aplicações, uso de SAST, DAST, SCA, gestão de vulnerabilidades, hardening, segregação de ambientes e validação de requisitos antes da entrada em produção.
• Atuar na resposta a incidentes de segurança da informação, apoiando atividades de detecção, contenção, erradicação, recuperação, investigação, lições aprendidas e melhoria contínua dos processos, com interface junto a times de infraestrutura, aplicações, arquitetura, privacidade, compliance e liderança executiva quando necessário.
• Avaliar tecnicamente novas soluções, fornecedores e serviços sob a ótica de segurança, privacidade e arquitetura, garantindo atendimento a requisitos mínimos como autenticação forte, criptografia, gestão de logs, auditabilidade, gestão de vulnerabilidades, controles de acesso, conformidade e práticas mínimas de desenvolvimento seguro.
• Produzir e apresentar materiais executivos e técnicos sobre riscos, maturidade, planos de ação, desvios de conformidade, status de remediação e evolução do roadmap de segurança, suportando comitês, auditorias, revisões de governança e fóruns estratégicos da organização.
• Promover a disseminação de cultura de segurança junto às equipes de tecnologia e negócio, apoiando treinamentos, definição de padrões, orientação técnica em projetos, fortalecimento de processos e incorporação de segurança e privacidade desde a concepção das iniciativas.

Especialista de Segurança da Informação

• Develop and maintain Information Security policies, standards and procedures;
• Evolve the Business Continuity program (BIA, BCP, testing);
• Lead security risk management (progressing toward FAIR);
• Conduct maturity assessments (ISF) and propose improvement plans (PDSI);
• Support and manage cyber insurance matters (renewals, evidence, claims);
• Perform vendor monitoring (risk assessment, due diligence, action plans);
• Participate in audit support and follow-up (internal and external);
• Respond to customer requirements and audits (questionnaires, evidence, contracts);
• Produce metrics and reports to support decision-making.

Security Engineer jobs in Brasil

See all jobs on JobTailor