Cybersecurity Manager - AppSec

McKinsey & Company; São Paulo; On-site; BRL 240,000 - 420,000; Full time

Job summary

McKinsey & Company is seeking an accomplished application security professional to integrate security into the software development lifecycle across engineering and product teams. The role focuses on embedding secure coding practices, DevSecOps, and cloud security policies, with hands-on reviews and coordination of testing.

You will partner with diverse teams to strengthen security across McKinsey's products, driving risk remediation decisions and reporting on posture and trends.

Qualifications

• 5+ years of corporate and/or professional services experience.
• Hands-on experience identifying and remediating vulnerability classes (OWASP Top 10) with SAST/DAST and SCA tooling.
• Familiarity with cloud security fundamentals and DevSecOps practices in AWS/Azure/GCP, including securing CI/CD pipelines.
• Proficiency in at least one programming language (Python/Java/JS/TS/Go) and reading multi-language codebases.
• Ability to manage multiple people and projects, fostering a trust-based, inclusive environment.
• Strong ability to raise issues, propose solutions, and perform under pressure.
• Non-hierarchical mindset with flexibility and consensus-building skills.
• Ability to handle multiple tasks with big-picture awareness.
• Discretion with confidential information and high professional standards.
• Strong influencing skills including delivering tough messages to senior audiences.

Responsibilities

• Act as application security point of contact for the firm, partnering with engineering and product teams to embed security in the software lifecycle.
• Drive adoption of secure coding, DevSecOps and cloud security policies across product and engineering teams.
• Conduct security reviews, including SAST/DAST and Software Composition Analysis, and coordinate penetration testing.
• Provide reporting on security posture, vulnerability trends, and compliance alignment.
• Contribute to security strategy and tooling for the Tech Ecosystem.

Skills

OWASP Top 10

SAST/DAST tooling

Cloud security

Programming languages

Leadership

Communication/Influence

Tools

SCA tooling

CI/CD security

Job description

Who You’ll Work With

You are someone who thrives in a high-performance environment, bringing a growth mindset and entrepreneurial spirit to tackle meaningful challenges that have a real impact.

You are someone who thrives in a high-performance environment, bringing a growth mindset and entrepreneurial spirit to tackle meaningful challenges that have a real impact. In return for your drive, determination, and curiosity, we’ll provide the resources, mentorship, and opportunities to help you quickly broaden your expertise, grow into a well-rounded professional, and contribute to work that truly makes a difference. When you join us, you will have:

• Continuous learning: Our learning and apprenticeship culture, backed by structured programs, is all about helping you grow while creating an environment where feedback is clear, actionable, and focused on your development. The real magic happens when you take the input from others to heart and embrace the fast-paced learning experience, owning your journey.
• A voice that matters: From day one, we value your ideas and contributions. You’ll make a tangible impact by offering innovative ideas and practical solutions, all while upholding our unwavering commitment to ethics and integrity. We not only encourage diverse perspectives, but they are critical in driving us toward the best possible outcomes.
• Global community: With colleagues across 65+ countries and over 100 different nationalities, our firm’s diversity fuels creativity and helps us come up with the best solutions. Plus, you’ll have the opportunity to learn from exceptional colleagues with diverse backgrounds and experiences.
• Exceptional benefits: On top of a competitive salary (based on your location, experience, and skills), we provide a comprehensive benefits package to enable holistic well-being for you and your family.

Your Impact

You will act as an application security point of contact for the firm, partnering with engineering and product teams to build security into the software development lifecycle. You will drive the promotion and adoption of secure coding practices and DevSecOps and Cloud security policies across product and engineering teams. You will conduct application security reviews, including secure code review, static and dynamic analysis (SAST/SCA/DAST), and coordination of penetration testing, and partner with product teams on vulnerability remediation and risk acceptance decisions. You will provide reporting on application security posture, vulnerability trends, and alignment with compliance and regulatory frameworks. You will also contribute to the development and continual improvement of the Tech Ecosystem application security strategy and tooling. Your work will help secure the products created by the developers and engineers at McKinsey that enable our consulting teams to deliver the value and impact McKinsey is known for. You will be based in Prague, San Jose, or Sao Paulo.

Your Qualifications and Skills

• 5+ years of corporate and/or professional services experience
• Hands-on experience identifying and remediating common vulnerability classes (e.g., OWASP Top 10), including practical experience with SAST, DAST, and software composition analysis (SCA) tooling
• Familiarity with cloud security fundamentals and DevSecOps practices in AWS, Azure, or GCP environments, including securing CI/CD pipelines
• Working proficiency in at least one programming language (e.g., Python, Java, JavaScript/TypeScript, Go), with the ability to read and reason about code across multiple languages and frameworks
• Independently manages multiple people and projects simultaneously while participating in best practices and nurturing a trust-based, inclusive, productive environment
• Capable of raising issues, generating solutions, and working effectively under pressure
• Non-hierarchical approach with flexibility and the ability to build consensus among team members.
• Ability to handle multiple tasks, prioritize them, and carry them out independently while being mindful of the big picture
• Sensitivity with confidential information and adherence to the highest professional and process standards
• Strong influencing capabilities, including willingness to push back and deliver tough messages to senior audiences, and demonstrated track record of leadership in high-performing teams
• Ability to engage audiences and create clear, logical, and structured communications across all formats
• Fluent level language skills in English, both written and verbal