Grupo QuintoAndar | Senior Security Engineer - CSIRT

Quintoandar; Brasil; Teletrabalho; BRL 180 000 - 300 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Competitive salary

Profit sharing

Meal allowance

Health insurance

Dental plan

Life insurance

Childcare subsidy

Home office allowance

Employee assistance program

Extended parental leave

Day off on birthday

Discounts on services

Reading kit for children

Resumo da oferta

Grupo QuintoAndar seeks a CSIRT Senior Engineer (SWE4) to lead incident response in a high-availability environment, guiding analysis, forensics, containment, and remediation. You will partner with MSSPs, the 24/7 SOC, and cross-functional teams to turn incidents into actionable intelligence.

The ideal candidate has 5+ years in DFIR or threat hunting, strong memory/host forensics, cloud incident experience (AWS/GCP), and SOAR automation skills.

Qualificações

• 5+ years in Incident Response, Digital Forensics or Threat Hunting.
• DFIR capability to preserve, collect, and analyze evidence across Windows, Linux, macOS networks.
• Proficiency in memory forensics and host-based forensics tools.

Responsabilidades

• Lead Level 2/3 security incidents as the primary technical contact.
• Coordinate with MSSPs and the 24/7 SOC for incident handling.
• Coordinate across Legal, DPO, Communications, and cyber teams during incidents.
• Create and refine IR playbooks, including automation.
• Lead DFIR investigations, conduct RCA, and prepare post-mortems.
• Develop and tune threat detection rules in SIEM/EDR.
• Leverage CTI to generate actionable intelligence for SOC.
• Collaborate with vendors to optimize incident response workflows.

Conhecimentos

Incident Response

Digital Forensics

Threat Hunting

Cloud Experience

SOAR Automation

DFIR Tools

Ferramentas

Memory Forensics

Host-Based Forensics

SIEM

EDR

SOAR

AWS/GCP

Descrição da oferta de emprego

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/.

Location & Remote Work

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

About the Position

Position Summary As a CSIRT Senior Engineer (SWE4), you will be the technical focal point and core pillar of the team during incidents. Beyond simply responding to alerts, your mission is to orchestrate defense by leading the complete response lifecycle: from analysis and forensic investigation support to making surgical containment and eradication decisions. Operating within a critical, high-availability ecosystem, you will serve as the bridge between tactical response and business continuity, ensuring not only swift operational recovery but also transforming every incident into actionable intelligence for the continuous evolution of our security posture.

Key Responsibilities

• Leadership in Critical and Complex Incidents: Serve as the primary technical point of contact during Level 2 and Level 3 security incidents, leading response efforts across complex, high-criticality environments.


• Partner Management and 24/7 Operations: Manage, mature, and coordinate responses alongside MSSPs and the 24/7 SOC, ensuring quality and alignment of actions.


• Cross-Functional Coordination: Coordinate efficiently and swiftly across multicultural teams and diverse business units (Legal, DPO, Communications, Cyber teams, etc.) during an incident.


• Playbook Development and Refinement: Create, maintain, and enhance Incident Response (IR) playbooks and procedures, integrating automation.


• DFIR and Post-Incident Analysis: Lead detailed forensic investigations to determine the root cause (Root Cause Analysis - RCA) and scope of compromise, facilitating meetings and preparing post-mortem documentation.


• Threat Detection: Advanced knowledge of threat detection, rule creation, and rule tuning/enhancement in SIEM and EDR.


• Cyber Threat Intelligence (CTI): In-depth mastery of the full CTI lifecycle, focusing on converting data into actionable intelligence to strengthen SOC routines.


• Vendor Management (Tier 1/Tier 2): Work in direct partnership with Tier 1 to optimize operational routines, maximizing value delivery from the active contract and vendor.

Qualifications and Required Skills

• Minimum Experience: At least 5 years of experience focused on Incident Response, Digital Forensics, or Threat Hunting.


• Essential Technical DFIR Mastery: Digital Forensics and Incident Response (DFIR) capability is essential. This includes the ability to preserve, collect, acquire, and analyze digital evidence across systems (Windows, Linux, macOS) as well as networks.


• Tool Proficiency: Proficiency in Memory Forensics and Host-Based Forensics tools.


• Basic Malware Analysis: Ability to perform basic static and dynamic analysis on malicious samples to extract IoCs and understand capabilities.


• Cloud Experience: Experience leading incident response in Cloud environments (AWS and GCP).


• Automation (SOAR): Proven experience with SOAR and building workloads that drive efficiency into the Incident Response process.


• Risk Management and Prioritization: Sharp risk perspective and the ability to prioritize actions and resources under pressure.


• Communication and Leadership: Proven ability to make fast decisions in high-pressure situations and excellent communication skills to articulate technical findings to both technical and executive audiences.

Benefits

• Competitive salary


• Profit sharing


• Meal allowance


• Health insurance


• Dental plan


• Life insurance


• Childcare subsidy and Atypical Parenthood subsidy


• Wellhub


• Home office allowance


• Employee assistance program (mental health, social, legal, and financial support)


• Extended parental leave


• Day off on birthday, Mother’s Day, and Father’s Day


• Benefits Club (discounts on everyday services)


• Discounts at educational institutions


• Reading kit for children – PlayKids

Diversity & Inclusion at Grupo QuintoAndar

We value diversity and want everyone to feel welcome here, regardless of their age, gender identity, sexual orientation, race, color, ethnicity, origin, disability, religion, or any other characteristic. All our job openings are open to all individuals!

You’ll notice there are some diversity questions in the application form. For affirmative action roles, this information may be used to verify your alignment with the target audience for the opportunity. In such cases, it may be used for elimination purposes. For non-affirmative action roles, this data will be used anonymously, exclusively to monitor and improve our inclusion practices in the hiring process, and will have no impact on your application.

Privacy and Data Protection

The Grupo QuintoAndar operates in compliance with privacy and data protection laws, including, but not limited to, the Brazilian General Personal Data Protection Law (LGPD) (Law No. 13,709/2018), and ensures the security of your data. To learn more, please access our Privacy Notice for Candidates. For questions or to exercise your rights as a data subject, please contact us through our Service Channel.