Senior Security Engineer

Evanthys; Brazil; Remote; BRL 180,000 - 240,000; Full time

Benefits offered by this job

100% Remote Work

Equity participation

Job summary

Evanthys is seeking a Mid-Level or Senior Security Engineer to lead our security program, drive SOC 2 readiness, and transform compliance into automated controls. You will work at the intersection of software engineering, cloud infra, and governance, shaping secure architecture while enabling rapid product development.

You will own security policies, automate controls, and collaborate with auditors and enterprise clients to uphold top-tier security standards across our engineering teams.

Qualifications

• 3–6 years in information security, DevSecOps, cloud security, or engineering with a security focus.
• Hands-on with SOC 2 or similar frameworks and audits.
• Cloud architectures (AWS or GCP) and container tech (Docker/Kubernetes).
• Ability to develop automation tools and document security controls for auditors.

Responsibilities

• Lead SOC 2 certification journey (Type I/II) and coordinate evidence with auditors.
• Develop and maintain security policies aligned with engineering culture (access, incident response, continuity, data lifecycle).
• Harden cloud infra and IAM, implement least privilege and governance.
• Embed security testing into CI/CD pipelines (SAST/DAST/SCA) and automate evidence collection.

Skills

Cloud architectures

Docker & Kubernetes

Automation

DevSecOps

SOC 2 familiarity

Auditor communication

Tools

Python

Bash

Go

CI/CD tooling

Job description

We work with highly sensitive data and mission-critical operations in an industry where trust is non-negotiable. As we scale our operations and establish partnerships with increasingly sophisticated enterprise clients, information security is evolving from an internal practice into a formalized competitive advantage.

We are looking for a Mid-Level or Senior Security Engineer with a strong engineering mindset to lead the next stage of maturity in our infrastructure and security governance. This includes driving our SOC 2 certification process and transforming compliance requirements into automated technical controls.

This role sits at the technical core of the company, operating at the intersection of Software Engineering, Cloud Infrastructure, and Security Governance.

Why This Role Might Be Right for You

Here, security is not a bureaucratic roadblock, nor does it operate in isolation from the codebase.

We are looking for someone who combines technical rigor with engineering pragmatism. You don't see audits and frameworks as mere stacks of documentation, but as systems and processes that should be thoughtfully architected, instrumented, and efficiently maintained.

You will have full autonomy to design our security architecture, standardize practices at scale, and lead technical discussions with auditors and enterprise clients — ensuring the highest industry standards without slowing down our product teams.

Key Responsibilities

Your mission is to formalize and strengthen our security posture, connecting technical architecture with enterprise compliance requirements.

Immediate Priorities - SOC 2 Certification & Technical Standardization

• Lead the SOC 2 certification journey (Type I and Type II): Conduct readiness assessments, establish the required technical and operational controls, coordinate evidence collection, and serve as the primary technical point of contact for external auditors.
• Technical Governance & Operational Policies: Develop, formalize, and maintain security policies aligned with our engineering culture, including Access Management, Incident Response, Business Continuity, and Data Lifecycle Management.
• Cloud & Infrastructure Hardening: Assess and improve cloud configurations (AWS/GCP), networks, VPCs, and container orchestration environments, applying least-privilege and defense-in-depth principles.
• Identity & Secrets Management (IAM): Standardize authentication mechanisms (SSO, MFA), granular access permissions, and the governance of credentials, keys, and secrets across all environments.
• Third-Party & Ecosystem Security: Establish technical and compliance criteria for evaluating and approving SaaS tools and external integrations.

Mid-Term Priorities - Automation, DevSecOps & Scale

• Compliance-as-Code: Implement tools for continuous control monitoring and automated evidence collection to support recurring audits.
• DevSecOps Integration: Embed security testing and analysis (SAST, DAST, SCA, and secrets detection) into CI/CD pipelines, providing engineering teams with visibility into security risks without introducing unnecessary deployment friction.
• Threat Modeling & Secure Architecture: Partner with product and engineering teams to design secure architectures for new features and sensitive data flows.
• Incident Response & Security Culture: Develop playbooks for threat detection, monitoring, and incident response, while promoting defensive security best practices across the organization.

What We're Looking For

• Proven Experience: 3-6 years of experience in Information Security, DevSecOps, Cloud Security, or Engineering with a specialization in security.
• Strong Technical & Engineering Background: Solid knowledge of cloud architectures (AWS or GCP), containers (Docker, Kubernetes), and the ability to develop automation tools or scripts using Python, Bash, Go, or similar languages.
• Familiarity with SOC 2 or Related Frameworks: Hands‑on experience preparing for audits, implementing security controls, or supporting compliance assessments (SOC 2 Type I/II, ISO 27001, HIPAA). Willingness to write technical documentation and explain and defend security controls to auditors.
• Pragmatism & Business Acumen: Ability to prioritize real security risks based on the company's stage and business needs, proposing effective solutions that strengthen security while preserving engineering agility.
• Clear & Effective Communication: Ability to engage with developers at the code level while confidently communicating the company's security posture to executives, auditors, and enterprise clients' security teams.

What We Offer

• Ownership & Meaningful Impact: Play a key role in shaping the company's security and compliance strategy, with a direct influence on technical architecture and decision-making.
• Decision-Making Autonomy: Freedom to select tools, design architectures, and establish standards that balance technical excellence with agility.
• 100% Remote Work: Flexibility to work from anywhere.
• Competitive Compensation + Equity: A compensation package aligned with your experience and seniority, including equity participation for those helping us build and grow the business.