Lead Engineer - AppSec

Accountabilities: Lead application security practices: Act as the technical security reference for Product and Engineering teams, integrating security early in the software development lifecycle without unnecessarily slowing delivery. Conduct threat modeling: Facilitate threat modeling sessions for new features and architectural changes, identifying potential attack paths, assessing risks, and recommending appropriate security controls before implementation. Perform security reviews and testing: Review application code and conduct manual security testing across web, API, and mobile applications to identify vulnerabilities such as cross-site scripting (XSS), insecure direct object references (IDOR), server-side request forgery (SSRF), injection flaws, and access control weaknesses. Strengthen automated security testing: Implement, maintain, and optimize Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and secrets detection tools within CI/CD pipelines. Manage vulnerabilities end to end: Triage, prioritize, track, and coordinate remediation activities, helping developers understand findings and implement effective fixes. Establish security standards: Develop secure coding guidelines, checklists, and best practices covering authentication, authorization, encryption, and personal data protection. Improve security visibility and performance: Assess the current application security landscape, including existing tools, vulnerability backlogs, and key product risks. Define metrics and remediation SLAs based on severity, including mean time to remediate. Embed security into development workflows: Incorporate threat modeling into the development of higher-risk features and ensure security checks are consistently applied to critical repositories. Coordinate penetration testing: Conduct or coordinate penetration tests for critical applications and APIs, working with engineering teams to establish and execute remediation plans. Support compliance and incident response: Contribute to initiatives aligned with LGPD, ISO 27001, and SOC 2 requirements, and participate in responding to application security incidents. Promote security awareness: Deliver training, share practical guidance, and foster a culture of shared responsibility for application security across engineering teams. Requirements Extensive experience in application security or software development with a strong focus on security engineering. In-depth knowledge of the OWASP Top 10, OWASP API Security Top 10, and common vulnerability classes, including injection, XSS, IDOR, SSRF, authentication failures, and access control issues. Ability to read, understand, and review application code, preferably in JavaScript/TypeScript and Node.js environments. Hands-on experience with application security testing tools such as Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, or comparable solutions. Proven experience integrating automated security checks into CI/CD pipelines, using tools such as GitHub Actions or Jenkins. Strong understanding of authentication and authorization protocols and mechanisms, including OAuth 2.0, OpenID Connect, and JSON Web Tokens (JWT). Experience managing vulnerabilities from discovery and triage through risk-based prioritization, remediation tracking, and verification. Ability to communicate technical security risks in clear business terms and build productive partnerships with software engineering teams. Strong analytical thinking, sound technical judgment, and a proactive approach to identifying and reducing security risks. Nice to have: Experience securing cloud environments, particularly AWS, including container and Kubernetes security. Nice to have: Knowledge of infrastructure-as-code security, especially Terraform. Nice to have: Experience conducting threat modeling for microservices architectures. Nice to have: Relevant security certifications, such as OSCP, OSWE, CSSLP, or equivalent. Nice to have: Familiarity with compliance frameworks and regulations, including LGPD, ISO 27001, and SOC 2. Nice to have: Experience working in SaaS companies that process large volumes of personal data. Benefits Meal allowance through a Caju benefits card. Medical insurance fully funded for the employee, with co-payments applicable to eligible dependents. Dental insurance. Life insurance. Home office allowance. Physical wellness benefits through Wellhub and TotalPass. Starbem online telemedicine and wellness services, including an introductory package of four psychology sessions, one nutrition session, and medical consultations. Guapeco pet health plan, including reimbursement at veterinary clinics throughout Brazil. Six months of maternity leave. Extended paternity leave. Inclusive parental leave policies covering same-sex couples, non-gestational mothers, and adoptive parents regardless of the child's age. Five days of marriage leave. Birthday day off. Internal employee recognition program with Gupy Coins redeemable for credits on the Caju card, including rewards such as entertainment, dining, and gaming vouchers. Access to Creditas payroll-deducted loans with lower interest rates. Financial education resources through Creditas. Access to Creditas Store, where eligible products and services can be paid for through payroll deductions. Optional Férias&Co subscription, with annual credits for booking accommodation and travel in Brazil and internationally, including a company subsidy toward part of the subscription fee. Opportunity to become a company partner through an employee ownership opportunity. Structured career development with multiple progression paths, including technical and management tracks. Ongoing learning opportunities, meaningful technical challenges, and career progression based on readiness for the next step. A collaborative and inclusive working environment with opportunities to influence application security practices and engineering quality.