Security Engineer (DevSecOps / AppSec)

Lever, Inc.; Brasil; Remote; BRL 250,000 - 360,000; Full time

Benefits offered by this job

Remote work model

30 days paid rest

Health and dental insurance

Job summary

Lever, Inc. is seeking a Security Engineer (DevSecOps / AppSec) in Brazil to integrate security into the SDLC. You will embed security practices in design, deployment, and operations, focusing on automation, threat modeling, and secure coding.

You will partner with engineers to identify vulnerabilities and implement secure solutions across cloud infrastructure and apps. You will lead a Security Champions program, perform risk assessments, and shape security standards for APIs, data, and

Qualifications

• Proven experience integrating security tooling into CI/CD workflows.
• Strong knowledge of AWS security services and IAM, S3, Lambda, VPC, KMS.
• Hands-on with Terraform and IaC security risk remediation.
• Familiarity with OWASP Top 10 and API Security.

Responsibilities

• Implement and maintain SAST, SCA, and secret scanning in CI/CD pipelines.
• Harden AWS infra and IaC including IAM, VPCs, KMS, and Terraform state.
• Lead Security Champions program and educate engineering squads.
• Perform security-focused code reviews for auth, APIs, and data.
• Develop automation scripts for security analysis and remediation.
• Collaborate with product and engineering to reduce risk.

Skills

CI/CD security

AWS security

Terraform

Python scripting

Threat modeling

Automation

Security reviews

Autonomous work

Cross-functional collaboration

Education

AWS Certified Solutions Architect

AWS Certified Security – Specialty

Certified DevSecOps Professional

HashiCorp Vault Associate

Tools

Terraform

HashiCorp Vault

AWS Secrets Manager

OWASP ZAP

Burp Suite

Docker

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (DevSecOps / AppSec) based in Brazil.

This is an opportunity to strengthen application and cloud security within a fast-growing technology environment. You will embed security practices directly into the software development lifecycle, from design through deployment. The role combines DevSecOps, Application Security, cloud security, infrastructure hardening, and risk management. You will work closely with engineering and product teams to identify vulnerabilities and build secure solutions proactively. A key part of the position will be developing security automation and empowering developers through a Security Champions program. You will also help shape security standards for APIs, integrations, authentication, sensitive data, and critical features. The role offers significant technical autonomy and the opportunity to influence security practices across the organization.

Accountabilities

• Implement and maintain SAST, SCA, secret-scanning, and other security controls within CI/CD pipelines across platforms such as Bitbucket, GitHub, and GitLab.
• Operate and continuously improve secrets-management solutions, including HashiCorp Vault and AWS Secrets Manager.
• Monitor repositories for exposed secrets and coordinate remediation with development teams.
• Perform security-focused code reviews for critical features involving authentication, authorization, external integrations, and sensitive data.
• Harden AWS infrastructure and infrastructure-as-code, including IAM policies, Terraform state, VPCs, Security Groups, KMS, and related configurations.
• Support remediation of vulnerabilities and findings identified through security tools, penetration tests, and internal assessments.
• Build and lead a Security Champions program by identifying security focal points within engineering squads and developing continuous enablement initiatives.
• Conduct threat modeling for new features, integrations, and critical architectural changes in partnership with product and engineering teams.
• Define, document, and promote security requirements throughout the SDLC, from architecture and design through deployment.
• Assess the security of internal and external APIs, partner integrations, authentication flows, and other critical application components.
• Develop scripts and automation to support security analysis, vulnerability remediation, and operational efficiency.
• Collaborate with engineering teams to strengthen security awareness, adoption of secure coding practices, and continuous risk reduction.

Requirements

• Practical experience with CI/CD pipelines and integrating security tooling such as SAST, SCA, and secret scanning into development workflows.
• Solid knowledge of AWS security services and practices, including IAM, S3, Lambda, Security Groups, VPC, KMS, and cloud security principles.
• Hands‑on experience with Terraform and the ability to identify and remediate security risks in infrastructure-as-code.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10, with the ability to apply these principles to code and architecture reviews.
• Ability to develop scripts and automations for security analysis and remediation using Python, Bash, or similar technologies.
• Ability to read and understand application code in at least one programming language used within a software product.
• Strong critical‑thinking and risk‑analysis skills, with the ability to assess vulnerabilities based on business and technical impact.
• Proactive and autonomous approach, with the ability to anticipate risks, take ownership, and drive security improvements through completion.
• Strong interpersonal and communication skills for working closely with software development and engineering teams.
• Collaborative mindset and ability to operate effectively across technical and cross‑functional teams.
• Strong ability to explain security concepts clearly and transfer knowledge to developers and other stakeholders.
• Experience with Bitbucket is a plus.
• Practical experience with HashiCorp Vault and/or AWS Secrets Manager is desirable.
• Familiarity with DAST tools such as OWASP ZAP or Burp Suite and their integration into CI/CD pipelines is desirable.
• Knowledge of Docker security and container image repositories is a plus.
• Experience applying CIS Benchmarks to AWS workloads is desirable.
• Familiarity with cloud security posture management tools such as Wiz, Prisma Cloud, AWS Security Hub, or GuardDuty is a plus.
• Experience reviewing serverless architectures involving Lambda and API Gateway is desirable.
• Knowledge of mobile security or binary analysis is considered an additional advantage.
• Relevant certifications such as AWS Certified Solutions Architect, AWS Certified Security – Specialty, Certified DevSecOps Professional, or HashiCorp Vault Associate are desirable.

Benefits

• Remote work model.
• PJ contract with 30 days of paid rest.
• Health and dental insurance with the monthly premium fully covered, subject to copayments for consultations and exams.
• Life insurance.
• Day off during your birthday month.
• Wellhub membership.
• Complete equipment kit for work.
• Daily transportation allowance of R$22 when working on-site.
• Home-office allowance of R$180 for professionals working remotely at least three days per week.
• Extended maternity and paternity leave.
• Opportunity to work on security initiatives with broad technical impact across cloud infrastructure, applications, and development processes.
• Inclusive opportunities, including consideration for people with disabilities.

We appreciate your interest and wish you the best!