Grupo QuintoAndar | Senior Security Engineer - CSIRT

Grupo QuintoAndar; Brasil; Híbrido; BRL 180 000 - 280 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Profit sharing

Health insurance

Life insurance

Childcare subsidy

Home office allowance

Employee assistance program

Extended parental leave

Birthday/holiday days off

Discounts on services

Resumo da oferta

Grupo QuintoAndar seeks a Senior Security Engineer for its CSIRT to be the technical focal point during security incidents, guiding containment, forensic analysis, and lessons learned. You will lead response across critical environments and work with cross-functional teams to improve defenses.

You will collaborate with MSSPs, the 24/7 SOC, and legal/communications teams while developing IR playbooks and automation to evolve our security posture in a remote-first Brazil-based setup.

Qualificações

• 5+ years in Incident Response, Digital Forensics, or Threat Hunting.
• DFIR mastery including preservation, collection, analysis across Windows/Linux/macOS and networks.
• Memory Forensics and Host-Based Forensics tools proficiency.
• Basic malware analysis to extract IoCs and understand capabilities.
• Cloud incident response leadership (AWS, GCP).
• Automation (SOAR) experience to drive efficiency in IR processes.

Responsabilidades

• Lead Level 2/3 incidents as primary technical POC.
• Coordinate with MSSPs and 24/7 SOC to ensure aligned actions.
• Cross-functional coordination with Legal, DPO, Communications, and Cyber teams during incidents.
• Develop and refine IR playbooks and introduce automation.
• Lead DFIR investigations and RCA meetings, documenting post-mortems.
• Advance threat detection through SIEM/EDR rule tuning and CTI.
• Manage Tier 1/2 vendor relationships to optimize operations.

Conhecimentos

Incident Response

Digital Forensics

Threat Hunting

Cloud (AWS/GCP)

SOAR/Automation

Risk Prioritization

Communication & Leadership

Ferramentas

Memory Forensics

Host-Based Forensics

Descrição da oferta de emprego

Grupo QuintoAndar | Senior Security Engineer - CSIRT

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world‑class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit:https://grupoquintoandar.com/pt/ .

Location & Remote Work

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

About the Position

Position Summary As a CSIRT Senior Engineer (SWE4), you will be the technical focal point and core pillar of the team during incidents. Beyond simply responding to alerts, your mission is to orchestrate defense by leading the complete response lifecycle: from analysis and forensic investigation support to making surgical containment and eradication decisions. Operating within a critical, high‑availability ecosystem, you will serve as the bridge between tactical response and business continuity, ensuring not only swift operational recovery but also transforming every incident into actionable intelligence for the continuous evolution of our security posture.

Key Responsibilities

• Leadership in Critical and Complex Incidents: Serve as the primary technical point of contact during Level 2 and Level 3 security incidents, leading response efforts across complex, high‑criticality environments.
• Partner Management and 24/7 Operations: Manage, mature, and coordinate responses alongside MSSPs and the 24/7 SOC, ensuring quality and alignment of actions.
• Cross‑Functional Coordination: Coordinate efficiently and swiftly across multicultural teams and diverse business units (Legal, DPO, Communications, Cyber teams, etc.) during an incident.
• Playbook Development and Refinement: Create, maintain, and enhance Incident Response (IR) playbooks and procedures, integrating automation.
• DFIR and Post‑Incident Analysis: Lead detailed forensic investigations to determine the root cause (Root Cause Analysis - RCA) and scope of compromise, facilitating meetings and preparing post‑mortem documentation.
• Threat Detection: Advanced knowledge of threat detection, rule creation, and rule tuning/enhancement in SIEM and EDR.
• Cyber Threat Intelligence (CTI): In‑depth mastery of the full CTI lifecycle, focusing on converting data into actionable intelligence to strengthen SOC routines.
• Vendor Management (Tier 1/Tier 2): Work in direct partnership with Tier 1 to optimize operational routines, maximizing value delivery from the active contract and vendor.

Qualifications and Required Skills

• Minimum Experience: At least 5 years of experience focused on Incident Response, Digital Forensics, or Threat Hunting.
• Essential Technical DFIR Mastery: Digital Forensics and Incident Response (DFIR) capability is essential. This includes the ability to preserve, collect, acquire, and analyze digital evidence across systems (Windows, Linux, macOS) as well as networks.
• Tool Proficiency: Proficiency in Memory Forensics and Host‑Based Forensics tools.
• Basic Malware Analysis: Ability to perform basic static and dynamic analysis on malicious samples to extract IoCs and understand capabilities.
• Cloud Experience: Experience leading incident response in Cloud environments (AWS and GCP).
• Automation (SOAR): Proven experience with SOAR and building workloads that drive efficiency into the Incident Response process.
• Risk Management and Prioritization: Sharp risk perspective and the ability to prioritize actions and resources under pressure.
• Communication and Leadership: Proven ability to make fast decisions in high‑pressure situations and excellent communication skills to articulate technical findings to both technical and executive audiences.
• Profit sharing
• Health insurance
• Life insurance
• Childcare subsidy and Atypical Parenthood subsidy
• Home office allowance
• Employee assistance program (mental health, social, legal, and financial support)
• Extended parental leave
• Day off on birthday, Mother’s Day, and Father’s Day
• Benefits Club (discounts on everyday services)
• Discounts at educational institutions

Diversity & Inclusion at Grupo QuintoAndar

We value diversity and want everyone to feel welcome here, regardless of their age, gender identity, sexual orientation, race, color, ethnicity, origin, disability, religion, or any other characteristic. All our job openings are open to all individuals!

You’ll notice there are some diversity questions in the application form. For affirmative action roles, this information may be used to verify your alignment with the target audience for the opportunity. In such cases, it may be used for elimination purposes. For non‑affirmative action roles, this data will be used anonymously, exclusively to monitor and improve our inclusion practices in the hiring process, and will have no impact on your application.

Privacy and Data Protection

The Grupo QuintoAndar operates in compliance with privacy and data protection laws, including, but not limited to, the Brazilian General Personal Data Protection Law (LGPD) (Law No. 13,709/2018), and ensures the security of your data. To learn more, please access our Privacy Notice for Candidates . For questions or to exercise your rights as a data subject, please contact us through our Service Channel .

Why do we ask for this information?

At Grupo QuintoAndar, we believe that diversity is the key to building an innovative and inclusive work environment.

To help us with this, we ask you to share some information about yourself. It is important for you to know that your data is completely anonymous to recruiters and anyone reviewing your resume. We use this information in an aggregated form — meaning without identifying you personally — to better understand who is participating in our selection processes and, thus, ensure that we are being more equitable and inclusive for everyone, right from the first contact.

By filling out this form, you help us create a QuintoAndar Group where everyone feels at home, welcomed, and valued.

If you do not feel comfortable answering any question, simply select the “I prefer not to answer” option.

We are counting on your help to continue improving our processes.

Please, select the options that best describe you.