Offensive Security Engineer

CloudWalk, Inc.; São Paulo; Presencial; BRL 180 000 - 300 000; Tempo integral

Resumo da oferta

CloudWalk, Inc. is seeking a security-focused professional to help break things that matter by pentesting applications, APIs, and infrastructure across our stack. You will design and run red-team campaigns to test resilience and build tooling that scales the team's impact.

The role emphasizes coding daily in Typescript or Go, and leveraging AI agents to detect and fix vulnerabilities in real time, with cloud and Kubernetes experience highly valued.

Qualificações

• Strong knowledge of vulnerabilities, exploitation techniques, and secure coding practices.
• Experience with web application and API pentesting; mobile pentesting (Android/iOS) is a strong plus.
• Proficiency in Typescript or Go; able to build tools and services others can rely on.
• Familiarity with cloud infrastructure security (GCP/AWS/Azure), Kubernetes, and CI/CD pipelines.
• Experience leveraging LLMs or AI agents for security tasks.

Responsabilidades

• Break things that matter. Pentest applications across our stack, identifying vulnerabilities in APIs, mobile apps (Android/iOS), and infrastructure before attackers do.
• Run red team operations. Plan and execute realistic attack campaigns: phishing with custom domains, social engineering, lateral movement, privilege escalation.
• Build offensive tooling. Engineer security platforms, scanning pipelines, and automation that multiply the team's impact.
• Weaponize AI for defense. Design and build LLM-powered agents that detect, classify, triage and fix vulnerabilities in real time.

Conhecimentos

Pentesting

Secure coding

Web/API pentesting

Mobile pentesting

Coding daily

Communication

Collaboration

Ferramentas

Typescript

Go

Kubernetes

CI/CD

Cloud platforms

LLMs/AI agents

Descrição da oferta de emprego

• Break things that matter. Pentest applications across our stack, identifying vulnerabilities in APIs, mobile apps (Android/iOS), and infrastructure before attackers do.
• Run red team operations. Plan and execute realistic attack campaigns: phishing with custom domains, social engineering, lateral movement, privilege escalation. Measure real organizational resilience, not checkbox compliance.
• Build offensive tooling. Engineer security platforms, scanning pipelines, and automation that multiply the team's impact.
• Weaponize AI for defense. Design and build LLM-powered agents that detect, classify, triage and fix vulnerabilities in real time.
  

About This Role

• Break things that matter. Pentest applications across our stack, identifying vulnerabilities in APIs, mobile apps (Android/iOS), and infrastructure before attackers do.
• Run red team operations. Plan and execute realistic attack campaigns: phishing with custom domains, social engineering, lateral movement, privilege escalation. Measure real organizational resilience, not checkbox compliance.
• Build offensive tooling. Engineer security platforms, scanning pipelines, and automation that multiply the team's impact.
• Weaponize AI for defense. Design and build LLM-powered agents that detect, classify, triage and fix vulnerabilities in real time.
  

What You Need To Succeed

Strong knowledge of common vulnerabilities, exploitation techniques, and secure coding practices. You can find bugs in source code, not just with a proxy. Experience with web application and API pentesting. Mobile pentesting (Android/iOS) is a strong plus. You code daily. Proficiency in Typescript, Go, or similar, not just scripts, but tools and services others can rely on. Familiarity with cloud infrastructure security (GCP/AWS/Azure), Kubernetes, and service mesh concepts. Understanding of CI/CD pipelines and how to embed security checks into them. Experience leveraging LLMs or AI agents for security tasks. Excellent communication and collaboration skills to work effectively with engineering teams.

Nice to Have

Experience with red team operations: phishing infrastructure, social engineering, C2 frameworks. Familiarity with payment industry security (PCI DSS, card tokenization, acquiring flows). Experience building security platforms or internal tooling (dashboards, bots, vulnerability management systems). Contributions to open source security tools, published security research or CTFs.

The Future We See

At CloudWalk, we envision a future where AI empowers every field to reach new heights:

• People teams leveraging AI to transform talent acquisition and employee development.
• Marketing professionals creating data-driven, AI-powered campaign strategies.
• Customer Success teams enhancing client experiences with intelligent solutions.
• Risk analysts combining human expertise with AI to navigate complexities.
• Designers collaborating with AI to push creative boundaries.

Join us at CloudWalk, where we're not just engineering solutions; we're building a smarter, AI-driven future for payments-together.