Senior Security Engineer

Evanthys; Brasil; Remote; BRL 180,000 - 320,000; Full time

Benefits offered by this job

100% Remote Work

Equity participation

Competitive compensation

Job summary

Evanthys is seeking a Mid-Level to Senior Security Engineer to drive SOC 2 readiness and modernize security governance. You will architect security controls across AWS/GCP, containers, and automation tooling, collaborating with engineering teams and auditors to balance security with velocity.

The role offers full remote work, opportunity to shape security policies, and hands-on leadership in compliance programs for enterprise partnerships.

Qualifications

• 3–6 years of information security, DevSecOps, cloud security, or engineering experience.
• Strong knowledge of cloud architectures (AWS or GCP), containers, and automation scripting.
• Experience with SOC 2 or related frameworks and audits.
• Ability to write technical documentation and explain controls to auditors.
• Pragmatic with business acumen and ability to balance security with engineering speed.

Responsibilities

• Lead SOC 2 certification journey and coordinate with auditors.
• Develop security policies: IAM, incident response, business continuity, data lifecycle.
• Harden cloud infra and networks; least privilege.
• Implement security controls in CI/CD: SAST/DAST/SCA/secrets detection.
• Establish security governance and automation for evidence collection.

Skills

Cloud architecture

Docker & Kubernetes

Automation scripting

Audits & compliance

Security documentation

Tools

Docker

Kubernetes

Python

Bash

Go

Job description

The Challenge

We work with highly sensitive data and mission-critical operations in an industry where trust is non-negotiable. As we scale our operations and establish partnerships with increasingly sophisticated enterprise clients, information security is evolving from an internal practice into a formalized competitive advantage.We are looking for a Mid-Level or Senior Security Engineer with a strong engineering mindset to lead the next stage of maturity in our infrastructure and security governance. This includes driving our SOC 2 certification process and transforming compliance requirements into automated technical controls.This role sits at the technical core of the company, operating at the intersection of Software Engineering, Cloud Infrastructure, and Security Governance.

Why This Role Might Be Right for You

Here, security is not a bureaucratic roadblock, nor does it operate in isolation from the codebase.We are looking for someone who combines technical rigor with engineering pragmatism. You don't see audits and frameworks as mere stacks of documentation, but as systems and processes that should be thoughtfully architected, instrumented, and efficiently maintained.You will have full autonomy to design our security architecture, standardize practices at scale, and lead technical discussions with auditors and enterprise clients — ensuring the highest industry standards without slowing down our product teams.

Key Responsibilities

Your mission is to formalize and strengthen our security posture, connecting technical architecture with enterprise compliance requirements.

Immediate Priorities — SOC 2 Certification & Technical Standardization

Lead the SOC 2 certification journey (Type I and Type II): Conduct readiness assessments, establish the required technical and operational controls, coordinate evidence collection, and serve as the primary technical point of contact for external auditors.

Technical Governance & Operational Policies: Develop, formalize, and maintain security policies aligned with our engineering culture, including Access Management, Incident Response, Business Continuity, and Data Lifecycle Management.

Cloud & Infrastructure Hardening: Assess and improve cloud configurations (AWS/GCP), networks, VPCs, and container orchestration environments, applying least-privilege and defense-in-depth principles.

Identity & Secrets Management (IAM): Standardize authentication mechanisms (SSO, MFA), granular access permissions, and the governance of credentials, keys, and secrets across all environments.

Third-Party & Ecosystem Security: Establish technical and compliance criteria for evaluating and approving SaaS tools and external integrations.

Mid-Term Priorities — Automation, DevSecOps & Scale

Compliance-as-Code: Implement tools for continuous control monitoring and automated evidence collection to support recurring audits.

DevSecOps Integration: Embed security testing and analysis (SAST, DAST, SCA, and secrets detection) into CI/CD pipelines, providing engineering teams with visibility into security risks without introducing unnecessary deployment friction.

Threat Modeling & Secure Architecture: Partner with product and engineering teams to design secure architectures for new features and sensitive data flows.

Incident Response & Security Culture: Develop playbooks for threat detection, monitoring, and incident response, while promoting defensive security best practices across the organization.

What We’re Looking For

• Proven Experience: 3–6 years of experience in Information Security, DevSecOps, Cloud Security, or Engineering with a specialization in security.
• Strong Technical & Engineering Background: Solid knowledge of cloud architectures (AWS or GCP), containers (Docker, Kubernetes), and the ability to develop automation tools or scripts using Python, Bash, Go, or similar languages.
• Familiarity with SOC 2 or Related Frameworks: Hands-on experience preparing for audits, implementing security controls, or supporting compliance assessments (SOC 2 Type I/II, ISO 27001, HIPAA). Willingness to write technical documentation and explain and defend security controls to auditors.
• Pragmatism & Business Acumen: Ability to prioritize real security risks based on the company's stage and business needs, proposing effective solutions that strengthen security while preserving engineering agility.
• Clear & Effective Communication: Ability to engage with developers at the code level while confidently communicating the company's security posture to executives, auditors, and enterprise clients' security teams.

What We Offer

• Ownership & Meaningful Impact: Play a key role in shaping the company's security and compliance strategy, with a direct influence on technical architecture and decision-making.
• Decision-Making Autonomy: Freedom to select tools, design architectures, and establish standards that balance technical excellence with agility.
• 100% Remote Work: Flexibility to work from anywhere.
• Competitive Compensation + Equity: A compensation package aligned with your experience and seniority, including equity participation for those helping us build and grow the business.