Grupo QuintoAndar | Senior Security Engineer - CSIRT

QuintoAndar; São Paulo; Híbrido; BRL 240 000 - 360 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Profit sharing

Health insurance

Life insurance

Childcare subsidy

Home office allowance

Employee assistance program

Extended parental leave

Day off on birthday

Resumo da oferta

Grupo QuintoAndar, the largest real estate ecosystem in Latin America, is seeking a CSIRT Senior Engineer to lead the incident response lifecycle, from analysis to containment and eradication, in a remote-first Brazil-based role.

You will collaborate with MSSPs and internal teams, drive playbook development, and turn incidents into intelligence to strengthen security posture; requires 5+ years DFIR, cloud experience, and strong leadership.

Qualificações

• Minimum 5+ years in Incident Response, Digital Forensics, or Threat Hunting.
• Essential DFIR mastery across Windows, Linux, macOS and networks.
• Proficient in memory and host-based forensics tools.
• Experience leading incident response in cloud environments (AWS, GCP).
• Automation with SOAR to drive IR efficiency.
• Strong risk prioritization and communication skills.

Responsabilidades

• Lead Level 2/3 security incidents as primary technical contact.
• Coordinate with MSSPs and 24/7 SOC for incident responses.
• Coordinate across Legal, DPO, Communications, and Cyber teams during incidents.
• Develop, maintain and refine IR playbooks and automated workflows.
• Oversee DFIR investigations and post-incident RCA and reports.
• Enhance threat detection rules in SIEM/EDR.
• Translate CTI into actionable intelligence for SOC improvements.
• Manage vendor relationships at Tier 1/2 to maximize value.

Conhecimentos

Incident Response

Digital Forensics

Threat Hunting

SOAR Automation

Cloud Security (AWS/GCP)

Communication & Leadership

Ferramentas

Memory Forensics

Host-Based Forensics

Descrição da oferta de emprego

Grupo QuintoAndar | Senior Security Engineer - CSIRT

About Grupo QuintoAndar

We are Grupo QuintoAndar, the largest real estate ecosystem in Latin America. Guided by a shared purpose of helping people love where they live, we have a diversified portfolio of brands and solutions across different countries in Latin America, covering all phases of the housing journey. We also have a Technology Hub in Portugal. We develop technology and innovation to transform and enhance the overall living experience.

With the support of a world-class team of investors and advisors, including Kaszek, Qualcomm, General Atlantic, and SoftBank, Grupo QuintoAndar is currently valued at over USD 5.1 billion and continues to grow year over year.

Here, you will work with top professionals in the market, in an environment that breathes innovation, collaboration, and high performance. To learn more about our story, visit: https://grupoquintoandar.com/pt/ .

Location & Remote Work

Our technology team operates under a "remote-first" model, which means we work from home and can live anywhere in Brazil. We also offer the option of working from our São Paulo offices or partner coworking spaces, up to twice a week.

About the Position

As a CSIRT Senior Engineer (SWE4), you will be the technical focal point and core pillar of the team during incidents. Beyond simply responding to alerts, your mission is to orchestrate defense by leading the complete response lifecycle: from analysis and forensic investigation support to making surgical containment and eradication decisions. Operating within a critical, high-availability ecosystem, you will serve as the bridge between tactical response and business continuity, ensuring not only swift operational recovery but also transforming every incident into actionable intelligence for the continuous evolution of our security posture.

Key Responsibilities

• Leadership in Critical and Complex Incidents: Serve as the primary technical point of contact during Level 2 and Level 3 security incidents, leading response efforts across complex, high-criticality environments.
• Partner Management and 24/7 Operations: Manage, mature, and coordinate responses alongside MSSPs and the 24/7 SOC, ensuring quality and alignment of actions.
• Cross-Functional Coordination: Coordinate efficiently and swiftly across multicultural teams and diverse business units (Legal, DPO, Communications, Cyber teams, etc.) during an incident.
• Playbook Development and Refinement: Create, maintain, and enhance Incident Response (IR) playbooks and procedures, integrating automation.
• DFIR and Post-Incident Analysis: Lead detailed forensic investigations to determine the root cause (Root Cause Analysis - RCA) and scope of compromise, facilitating meetings and preparing post-mortem documentation.
• Threat Detection: Advanced knowledge of threat detection, rule creation, and rule tuning/enhancement in SIEM and EDR.
• Cyber Threat Intelligence (CTI): In-depth mastery of the full CTI lifecycle, focusing on converting data into actionable intelligence to strengthen SOC routines.
• Vendor Management (Tier 1/Tier 2): Work in direct partnership with Tier 1 to optimize operational routines, maximizing value delivery from the active contract and vendor.

Qualifications and Required Skills

• Minimum Experience: At least 5 years of experience focused on Incident Response, Digital Forensics, or Threat Hunting.
• Essential Technical DFIR Mastery: Digital Forensics and Incident Response (DFIR) capability is essential. This includes the ability to preserve, collect, acquire, and analyze digital evidence across systems (Windows, Linux, macOS) as well as networks.
• Tool Proficiency: Proficiency in Memory Forensics and Host-Based Forensics tools.
• Basic Malware Analysis: Ability to perform basic static and dynamic analysis on malicious samples to extract IoCs and understand capabilities.
• Cloud Experience: Experience leading incident response in Cloud environments (AWS and GCP).
• Automation (SOAR): Proven experience with SOAR and building workloads that drive efficiency into the Incident Response process.
• Risk Management and Prioritization: Sharp risk perspective and the ability to prioritize actions and resources under pressure.
• Communication and Leadership: Proven ability to make fast decisions in high-pressure situations and excellent communication skills to articulate technical findings to both technical and executive audiences.
• Profit sharing
• Health insurance
• Life insurance
• Childcare subsidy and Atypical Parenthood subsidy
• Home office allowance
• Employee assistance program (mental health, social, legal, and financial support)
• Extended parental leave
• Day off on birthday, Mother's Day, and Father's Day
• Benefits Club (discounts on everyday services)
• Discounts at educational institutions

Diversity & Inclusion at Grupo QuintoAndar

We value diversity and want everyone to feel welcome here, regardless of their age, gender identity, sexual orientation, race, color, ethnicity, origin, disability, religion, or any other characteristic. All our job openings are open to all individuals!

You’ll notice there are some diversity questions in the application form. For affirmative action roles, this information may be used to verify your alignment with the target audience for the opportunity. In such cases, it may be used for elimination purposes. For non‑affirmative action roles, this data will be used anonymously, exclusively to monitor and improve our inclusion practices in the hiring process, and will have no impact on your application.

Privacy and Data Protection

The Grupo QuintoAndar operates in compliance with privacy and data protection laws, including, but not limited to, the Brazilian General Personal Data Protection Law (LGPD) (Law No. 13,709/2018), and ensures the security of your data. To learn more, please access our Privacy Notice for Candidates. For questions or to exercise your rights as a data subject, please contact us through our Service Channel.