Security Engineer (DevSecOps / AppSec)

Accountabilities: Implement and maintain SAST, SCA, secret-scanning, and other security controls within CI/CD pipelines across platforms such as Bitbucket, GitHub, and GitLab. Operate and continuously improve secrets-management solutions, including HashiCorp Vault and AWS Secrets Manager. Monitor repositories for exposed secrets and coordinate remediation with development teams. Perform security-focused code reviews for critical features involving authentication, authorization, external integrations, and sensitive data. Harden AWS infrastructure and infrastructure-as-code, including IAM policies, Terraform state, VPCs, Security Groups, KMS, and related configurations. Support remediation of vulnerabilities and findings identified through security tools, penetration tests, and internal assessments. Build and lead a Security Champions program by identifying security focal points within engineering squads and developing continuous enablement initiatives. Conduct threat modeling for new features, integrations, and critical architectural changes in partnership with product and engineering teams. Define, document, and promote security requirements throughout the SDLC, from architecture and design through deployment. Assess the security of internal and external APIs, partner integrations, authentication flows, and other critical application components. Develop scripts and automation to support security analysis, vulnerability remediation, and operational efficiency. Collaborate with engineering teams to strengthen security awareness, adoption of secure coding practices, and continuous risk reduction. Requirements Practical experience with CI/CD pipelines and integrating security tooling such as SAST, SCA, and secret scanning into development workflows. Solid knowledge of AWS security services and practices, including IAM, S3, Lambda, Security Groups, VPC, KMS, and cloud security principles. Hands-on experience with Terraform and the ability to identify and remediate security risks in infrastructure-as-code. Strong understanding of OWASP Top 10 and OWASP API Security Top 10, with the ability to apply these principles to code and architecture reviews. Ability to develop scripts and automations for security analysis and remediation using Python, Bash, or similar technologies. Ability to read and understand application code in at least one programming language used within a software product. Strong critical-thinking and risk-analysis skills, with the ability to assess vulnerabilities based on business and technical impact. Proactive and autonomous approach, with the ability to anticipate risks, take ownership, and drive security improvements through completion. Strong interpersonal and communication skills for working closely with software development and engineering teams. Collaborative mindset and ability to operate effectively across technical and cross-functional teams. Strong ability to explain security concepts clearly and transfer knowledge to developers and other stakeholders. Experience with Bitbucket is a plus. Practical experience with HashiCorp Vault and/or AWS Secrets Manager is desirable. Familiarity with DAST tools such as OWASP ZAP or Burp Suite and their integration into CI/CD pipelines is desirable. Knowledge of Docker security and container image repositories is a plus. Experience applying CIS Benchmarks to AWS workloads is desirable. Familiarity with cloud security posture management tools such as Wiz, Prisma Cloud, AWS Security Hub, or GuardDuty is a plus. Experience reviewing serverless architectures involving Lambda and API Gateway is desirable. Knowledge of mobile security or binary analysis is considered an additional advantage. Relevant certifications such as AWS Certified Solutions Architect, AWS Certified Security – Specialty, Certified DevSecOps Professional, or HashiCorp Vault Associate are desirable. Benefits Remote work model. PJ contract with 30 days of paid rest. Health and dental insurance with the monthly premium fully covered, subject to copayments for consultations and exams. Life insurance. Day off during your birthday month. Wellhub membership. Complete equipment kit for work. Daily transportation allowance of R$22 when working on-site. Home-office allowance of R$180 for professionals working remotely at least three days per week. Extended maternity and paternity leave. Opportunity to work on security initiatives with broad technical impact across cloud infrastructure, applications, and development processes. Inclusive opportunities, including consideration for people with disabilities.