Grupo QuintoAndar | Senior Offensive Security Engineer
Grupo QuintoAndar
A complete application in a minute
Tailored resume and cover letter, ready to send.
Benefits offered by this job
Job summary
Grupo QuintoAndar is seeking a Senior Offensive Security Engineer to lead AI-driven offensive security initiatives across distributed, containerized environments. You will design autonomous agents, map attack surfaces, and coordinate with Defensive Security, CTI, and Engineering teams to drive secure software delivery.
You will mentor engineers, write RFCs, and help shape risk-based remediation strategies while operating in a remote-first Brazil setting with potential office work in São Paulo.
Qualifications
- Offensive Security track record in senior roles (red/purple team)
- Experience with AI-driven/agentic security architectures
- Deep knowledge of container runtimes and Kubernetes in cloud environments
- Solid programming skills for production tooling and pipelines
- Experience integrating offensive findings into vulnerability management and SIEM workflows
Responsibilities
- Architect autonomous offensive systems powered by AI agents.
- Conduct continuous testing of global attack surfaces across microservices and Kubernetes clusters.
- Integrate findings with vulnerability management pipelines and SIEM/SOAR tools.
- Lead multi-team delivery, risk mapping, and RFC/design documentation.
- Mentor engineers and drive architectural reviews and best practices.
Skills
Tools
Job description
We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.
With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.
Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/ .
- Possibility of learning;
- Opportunity to work in a team that seeks to use the best practices and tools in the market;
- Work in an informal environment with a horizontal structure;
- Being part of a team working on a high-impact project that affects the lives of thousands of people.
Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.
This job description is written in English because for that position you will need it for communications with coworkers and suppliers who are from worldwide, for tools and internal materials as well.
Our selection process currently lasts an average of 40 days, from application to completion of the assessment. Going through:
- Application
- Interview with Recruiters
- Tech Screening with Engineering Team (Coding Interview)
- Technicals Interviews (Architecture live cases)
- Offer
QuintoAndar is transforming the real estate ecosystem globally through cutting-edge technology, product velocity, and operational scale. As our digital footprint expands across distributed platforms, microservices, and regional markets, traditional penetration testing and point-in-time assessments can no longer match our pace of deployment.
We are seeking a Senior Offensive Security Engineer (SE4 - Banda 8) to spearhead a paradigm shift: pioneering, architecting, and piloting our AI-Driven Offensive Security Program. In this role, you will design and orchestrate a distributed "squad" of autonomous AI agents capable of continuous reconnaissance, dynamic attack surface mapping, deep penetration testing, smart triage, and automated verification across QuintoAndar's global infrastructure, containerized workloads, Kubernetes clusters, and customer-facing products.
Operating as a Senior Engineer, you will combine world-class offensive engineering depth with strategic systems design, stakeholder influence, and mentorship. You will bridge offensive capabilities directly with our Defensive Security, Cyber Threat Intelligence (CTI), Vulnerability Management, and Engineering teams, ensuring risks are mapped, contextualized, and systematically eliminated.
- Architect Autonomous Offensive Systems: Design, build, and pilot the end-to-end architecture of an AI-agent-powered offensive security platform. Select model paradigms, agentic frameworks, and tool-use orchestration pipelines to autonomously identify attack paths, test APIs/applications, and probe cloud-native environments.
- Global Attack Surface Operations: Plan, conduct continuous, systematic testing against QuintoAndar’s global attack surface, complex microservices architectures, containerized workloads, and kubernetes clusters.
- Unified Ecosystem Integration: Close the loop between offense and defense. Connect automated agent findings with Vulnerability Management pipelines, SIEM/SOAR platforms, CTI feeds, and Blue Team detection engineering workflows to drive real-time remediation, automated retests, and proactive defense tuning.
- Architecture & RFCs: Write comprehensive RFCs and technical design documents defining AI agent protocols, offensive automation standards, containment boundaries, and secure sandboxing mechanisms to ensure autonomous testing runs safely and reliably in production and non-production environments.
- End-to-End Delivery: Drive complex, multi-team engineering deliverables from scoping to operational deployment, balancing bold innovation with platform resilience and uptime.
- Risk Mapping & Executive Communication: Translate complex attack graphs, exploitation proofs-of-concept (PoCs), and vulnerability telemetry into clear business risk impact for Product Managers, Engineering Directors, and executive forums.
- Strategic Triaging & Retesting: Automate the noise out of vulnerability triage. Deploy AI agent capabilities to dynamically validate exploitability, evaluate environmental compensating controls, prioritize remediation based on actual business exposure, and execute automated retests upon patch release.
- Incident Ownership & Operational Stability: Serve as a subject matter expert during severe security incidents, contributing deep adversary perspectives, leading red/purple team debriefs, and eventually owning corrective post-mortem engineering initiatives.
- Raise the Technical Bar: Lead offensive architecture reviews and threat modeling sessions across core platforms, enforcing high benchmarks for resilience, monitoring, and defensive posture.
- Talent Multiplier: Mentor and elevate senior and mid-level security engineers across the team. Delegate critical architectural tracks to foster growth, design interview standards for offensive and AI hiring, and build an environment grounded in psychological safety and high performance.
- Offensive Security Track Record: Proven background operating as a Senior/Staff Offensive Security Engineer, Senior “Red Teamer”, or Principal Penetration Tester conducting complex assessments against web apps, APIs, distributed cloud environments, and internal networks.
- AI & Agentic Architectures: Hands-on experience developing or architecting LLM-driven applications, agentic workflows, tool calling, autonomous agent sandboxing, and adversarial AI evaluation.
- Cloud-Native & Container Mastery: Deep practical knowledge of container runtimes, Kubernetes architecture (RBAC, admission controllers, pod security standards, network policies, service mesh), and major cloud platforms. Demonstrated capability exploiting and hardening containerized infrastructure.
- Software Engineering Fundamentals: Solid programming proficiency to build production-grade tooling, microservices, pipeline integrations, and custom agent skills.
- Vulnerability Management & Detection Integration: Proven experience integrating offensive discoveries into enterprise vulnerability management engines (Jira, DefectDojo, or custom risk aggregators) and telemetry tools (SIEM).
- Cross-Department Influence: Demonstrated success leading initiatives that cut across engineering, product, and infrastructure boundaries, negotiating technical roadmaps, and resolving cross-system dependencies.
- Business-Centric Mindset: Ability to evaluate technical risk through a business value and revenue-impact lens, prioritizing vulnerabilities that threaten platform trust, customer data, and transactional operations.
- Communication & Presence: Exceptional verbal and written communication skills; experienced in presenting technical strategies to senior leadership and translating complex security topics for non-technical stakeholders.
- Commitment to Engineering Rigor: Strong track record of contributing to and reviewing RFCs, institutionalizing best practices, and mentoring junior and mid-level peers.
- Experience operating red/purple team operations in high-velocity tech, fintech, or hyper-growth marketplaces.
- Prior open-source contributions or research in automated exploitation, agentic systems, or cloud security tooling.
- Industry certifications demonstrating deep offensive or cloud knowledge (e.g., OSCP, OSEP, OSWE, CKS, AWS Certified Security - Specialty) or equivalent demonstrated domain expertise.
We value diversity and want everyone to feel welcome here, regardless of their age, gender identity, sexual orientation, race, color, ethnicity, origin, disability, religion, or any other characteristic. All our job openings are open to all individuals!
You’ll notice there are some diversity questions in the application form. For affirmative action roles, this information may be used to verify your alignment with the target audience for the opportunity. In such cases, it may be used for elimination purposes. For non-affirmative action roles, this data will be used anonymously, exclusively to monitor and improve our inclusion practices in the hiring process, and will have no impact on your application.
To learn more, please access our Privacy Notice for Candidates . For questions or to exercise your rights as a data subject, please contact us through our Service Channel .
- Profit sharing
- Health insurance
- Life insurance
- Childcare subsidy and Atypical Parenthood subsidy
- Home office allowance
- Employee assistance program (mental health, social, legal, and financial support)
- Extended parental leave
- Day off on birthday, Mother’s Day, and Father’s Day
- Benefits Club (discounts on everyday services)
- Discounts at educational institutions
'/%3e%3cpath%20d='M101.744%2012.4726L102.894%2016.1947L99.0021%2013.2201L101.744%2012.4726ZM105.3%208.40937H100.488L99.0026%203.59473L97.5116%208.41047L92.7%208.40385L96.5965%2011.3834L95.1055%2016.1942L99.0021%2013.2196L101.408%2011.3834L105.3%208.40992V8.40937Z'%20fill='white'/%3e%3cdefs%3e%3clinearGradient%20id='paint0_linear_5593_1381'%20x1='90'%20y1='9.44471'%20x2='99'%20y2='9.44471'%20gradientUnits='userSpaceOnUse'%3e%3cstop%20stop-color='%2300AD70'/%3e%3cstop%20offset='0.998594'%20stop-color='%2300B67A'/%3e%3cstop%20offset='1'%20stop-color='%23DCDCE6'/%3e%3c/linearGradient%3e%3c/defs%3e%3c/svg%3e){kind=small}
