Lead Engineer - AppSec

Jobgether; Brasil; Remote; BRL 350,000 - 520,000; Full time

Benefits offered by this job

Meal allowance via Caju card

Medical insurance for employee

Dental insurance

Life insurance

Home office allowance

Wellness benefits & telemedicine

Job summary

Jobgether, acting on behalf of a partner company, is seeking a Lead Engineer – Application Security (AppSec) based in Brazil. The role embraces embedding security across the software lifecycle, leading threat modeling, security reviews, and remediation of critical vulnerabilities.

You will drive automated testing integration, collaborate with Product and Engineering, and contribute to a strong security culture. This remote, full-time opportunity welcomes applicants with disabilities.

Qualifications

• Extensive experience in application security or software development with a security focus.
• Deep knowledge of OWASP Top 10, OWASP API Top 10, and common vulnerability classes.
• Ability to read and review code, preferably JavaScript/TypeScript and Node.js.
• Hands-on experience with security testing tools listed above.
• Experience integrating automated security checks into CI/CD pipelines.

Responsibilities

• Lead application security practices as the technical security reference for teams.
• Facilitate threat modeling for new features and architecture changes.
• Perform manual security testing across web, API, and mobile apps.
• Strengthen automated security testing within CI/CD (SAST/DAST/SCA).
• Coordinate vulnerability triage, remediation tracking, and disclosure.
• Develop secure coding guidelines and checklists.
• Improve risk visibility with security metrics and SLAs.
• Embed security checks into development workflows for high-risk features.
• Coordinate penetration testing and remediation plans with engineering.
• Support LGPD, ISO 27001, SOC 2 initiatives and incident response.
• Promote security awareness through training and best practices.

Skills

Extensive experience in AppSec or dev,

OWASP Top 10 & API Top 10 knowledge

Ability to read/review code (JS/TS, in

Tools

Burp Suite

OWASP ZAP

Semgrep

SonarQube

Snyk

GitHub Actions

Jenkins

Job description

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Lead Engineer – Application Security (AppSec) based in Brazil.

We are seeking an experienced application security leader to embed security throughout the software development lifecycle while enabling engineering teams to deliver quickly and confidently. In this role, you will serve as a technical reference for Product and Engineering, proactively identifying risks and strengthening the security of web, API, and mobile applications. You will lead threat modeling, security code reviews, vulnerability management, and the integration of automated security testing into CI/CD pipelines. Working collaboratively with developers and other stakeholders, you will establish practical security standards, improve risk visibility, and drive remediation of critical vulnerabilities. You will also contribute to compliance initiatives, incident response, and the development of a strong security culture. This is a remote, full-time opportunity in a collaborative technology environment, open to people with disabilities.

Accountabilities

• Lead application security practices: Act as the technical security reference for Product and Engineering teams, integrating security early in the software development lifecycle without unnecessarily slowing delivery.
• Conduct threat modeling: Facilitate threat modeling sessions for new features and architectural changes, identifying potential attack paths, assessing risks, and recommending appropriate security controls before implementation.
• Perform security reviews and testing: Review application code and conduct manual security testing across web, API, and mobile applications to identify vulnerabilities such as cross-site scripting (XSS), insecure direct object references (IDOR), server-side request forgery (SSRF), injection flaws, and access control weaknesses.
• Strengthen automated security testing: Implement, maintain, and optimize Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and secrets detection tools within CI/CD pipelines.
• Manage vulnerabilities end to end: Triage, prioritize, track, and coordinate remediation activities, helping developers understand findings and implement effective fixes.
• Establish security standards: Develop secure coding guidelines, checklists, and best practices covering authentication, authorization, encryption, and personal data protection.
• Improve security visibility and performance: Assess the current application security landscape, including existing tools, vulnerability backlogs, and key product risks. Define metrics and remediation SLAs based on severity, including mean time to remediate.
• Embed security into development workflows: Incorporate threat modeling into the development of higher-risk features and ensure security checks are consistently applied to critical repositories.
• Coordinate penetration testing: Conduct or coordinate penetration tests for critical applications and APIs, working with engineering teams to establish and execute remediation plans.
• Support compliance and incident response: Contribute to initiatives aligned with LGPD, ISO 27001, and SOC 2 requirements, and participate in responding to application security incidents.
• Promote security awareness: Deliver training, share practical guidance, and foster a culture of shared responsibility for application security across engineering teams.

Requirements

• Extensive experience in application security or software development with a strong focus on security engineering.
• In-depth knowledge of the OWASP Top 10, OWASP API Security Top 10, and common vulnerability classes, including injection, XSS, IDOR, SSRF, authentication failures, and access control issues.
• Ability to read, understand, and review application code, preferably in JavaScript/TypeScript and Node.js environments.
• Hands-on experience with application security testing tools such as Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, or comparable solutions.
• Proven experience integrating automated security checks into CI/CD pipelines, using tools such as GitHub Actions or Jenkins.
• Strong understanding of authentication and authorization protocols and mechanisms, including OAuth 2.0, OpenID Connect, and JSON Web Tokens (JWT).
• Experience managing vulnerabilities from discovery and triage through risk-based prioritization, remediation tracking, and verification.
• Ability to communicate technical security risks in clear business terms and build productive partnerships with software engineering teams.
• Strong analytical thinking, sound technical judgment, and a proactive approach to identifying and reducing security risks.
• Nice to have: Experience securing cloud environments, particularly AWS, including container and Kubernetes security.
• Nice to have: Knowledge of infrastructure-as-code security, especially Terraform.
• Nice to have: Experience conducting threat modeling for microservices architectures.
• Nice to have: Relevant security certifications, such as OSCP, OSWE, CSSLP, or equivalent.
• Nice to have: Familiarity with compliance frameworks and regulations, including LGPD, ISO 27001, and SOC 2.
• Nice to have: Experience working in SaaS companies that process large volumes of personal data.

Benefits

• Meal allowance through a Caju benefits card.
• Medical insurance fully funded for the employee, with co-payments applicable to eligible dependents.
• Dental insurance.
• Life insurance.
• Home office allowance.
• Physical wellness benefits through Wellhub and TotalPass.
• Starbem online telemedicine and wellness services, including an introductory package of four psychology sessions, one nutrition session, and medical consultations.
• Guapeco pet health plan, including reimbursement at veterinary clinics throughout Brazil.
• Six months of maternity leave.
• Extended paternity leave.
• Inclusive parental leave policies covering same-sex couples, non-gestational mothers, and adoptive parents regardless of the child's age.
• Five days of marriage leave.
• Birthday day off.
• Internal employee recognition program with Gupy Coins redeemable for credits on the Caju card, including rewards such as entertainment, dining, and gaming vouchers.
• Access to Creditas payroll-deducted loans with lower interest rates.
• Financial education resources through Creditas.
• Access to Creditas Store, where eligible products and services can be paid for through payroll deductions.
• Optional Férias&Co subscription, with annual credits for booking accommodation and travel in Brazil and internationally, including a company subsidy toward part of the subscription fee.
• Opportunity to become a company partner through an employee ownership opportunity.
• Structured career development with multiple progression paths, including technical and management tracks.
• Ongoing learning opportunities, meaningful technical challenges, and career progression based on readiness for the next step.
• A collaborative and inclusive working environment with opportunities to influence application security practices and engineering quality.