Senior Software Engineer, Security Platform

Jobgether SRL; Brasil; Teletrabalho; BRL 282 000 - 536 000; Tempo integral

Vantagens oferecidas por esta oferta de emprego

Fully remote work

High‑impact engineering

Modern technology stack

AI‑driven development

Technical autonomy

Collaborative engineering culture

Continuous learning

Quality‑focused environment

Meaningful impact

Resumo da oferta

Jobgether SRL is seeking a Senior Software Engineer specializing in Security Platform to design, build, and operate scalable security tooling. You will work primarily with Go, Python, AWS, and Kubernetes to automate vulnerability triage, secure CI/CD gates, and enforce secure development practices.

The role emphasizes hands-on engineering, threat modeling, and collaboration with security and software teams to embed security into the development lifecycle.

Qualificações

• At least 6 years of professional software engineering experience with backend and production systems.
• Strong Go and Python programming skills; production-grade service experience.
• Experience with event-driven/messaging architectures (NATS, Kafka).
• Practical CI/CD tooling experience; GitLab CI at scale is a plus.
• Web app security knowledge and OWASP Top 10 competence.
• Experience with cloud-native tech (AWS, Kubernetes).
• Experience with security scanning tools (SAST, SCA, secret scanning).
• Familiarity with SBOM pipelines, artifact signing, provenance tech (Sigstore/SLSA).
• Bachelor's degree in CS/CE or related discipline.

Responsabilidades

• Design, build, and maintain security platform services in Go and Python on AWS/Kubernetes.
• Own and optimize event-driven messaging and observability for security tooling.
• Integrate security scanners and vulnerability management with CI/CD pipelines.
• Develop AI-assisted security workflows and automated remediation agents.
• Contribute to threat modeling, secure design reviews, and on-call reliability.

Conhecimentos

Go (Golang)

Python

AWS

Kubernetes

Event-driven architecture

CI/CD tooling

Application security

NATS

Kafka

GitLab CI

Formação académica

Bachelor's degree in Computer Science/Engineering

Ferramentas

NATS

Kafka

GitLab CI

SAST/SCA tools

Semgrep

Descrição da oferta de emprego

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Software Engineer, Security Platform based in Brazil.

As a Senior Software Engineer, Security Platform, you will design, build, and maintain the software infrastructure that powers modern security operations across cloud environments and applications. You will develop backend services, event-driven systems, and automated security controls that help engineering teams identify and resolve vulnerabilities efficiently. Working primarily with Go, Python, AWS, and Kubernetes, you will strengthen the reliability, scalability, and effectiveness of security tooling across the development lifecycle. You will also build intelligent, AI-assisted workflows that streamline vulnerability triage, code reviews, and remediation processes. Collaborating with security and engineering specialists, you will turn security requirements into practical, automated solutions that protect systems without slowing product delivery. This is an exciting opportunity for a hands‑on engineer who enjoys solving complex technical challenges, taking ownership of production systems, and making security an integral part of software development.

Accountabilities

• Security platform engineering: Design, develop, deploy, and maintain security engineering services primarily in Go and Python, running on AWS and Kubernetes. Build new capabilities, improve existing services, strengthen reliability, and retire outdated components when appropriate.
• Event-driven architecture: Own and enhance the messaging infrastructure connecting security services, including the NATS event bus, message contracts, consumers, delivery guarantees, replay mechanisms, back‑pressure handling, and observability.
• End‑to‑end security integrations: Connect security scanners, vulnerability management systems, ticketing platforms, and metrics dashboards to ensure findings are tracked from discovery through remediation, with clear ownership and reliable audit evidence.
• CI/CD security controls: Build and maintain security gates across GitLab CI pipelines, covering static application security testing (SAST), software composition analysis (SCA), secret detection, container scanning, and infrastructure‑as‑code (IaC) scanning.
• Security gate optimization: Select and configure scanning tools, tune detection rules, manage suppression workflows, reduce false positives, and develop rollout mechanisms that move controls from advisory reporting to enforcement without unnecessarily disrupting engineering delivery.
• AI‑assisted security workflows: Develop reusable AI‑powered tools and agentic workflows, including automated code‑review agents, vulnerability triage systems, verification processes, and remediation assistants that other engineers can adopt effectively.
• Vulnerability triage and remediation: Validate security findings, confirm true positives, provide reproduction details and actionable remediation guidance, and automate the routing of issues to responsible engineering teams and vulnerability‑management operations.
• Secure software development: Apply practical web application security expertise to identify and fix vulnerabilities, incorporate security checks into development workflows, and prevent recurring vulnerability patterns across the engineering organization.
• Threat modeling and secure design: Participate in threat modeling and security design reviews for the services, integrations, and development pipelines under your responsibility.
• Operational reliability: Monitor and improve the performance, availability, and maintainability of security platform services, and participate in the on‑call rotation for the systems you own.
• Cross‑functional collaboration: Partner with security, infrastructure, and software engineering teams to embed effective security controls into everyday development practices while maintaining speed, reliability, and developer productivity.
• Continuous improvement: Apply automation, engineering best practices, and AI‑assisted development techniques to improve platform efficiency, code quality, and the overall effectiveness of security operations.

Requirements

• Professional experience: At least 6 years of professional software engineering experience, including substantial backend development and hands‑on responsibility for production systems. Candidates should demonstrate recent practical development experience, including significant production changes delivered within the past 30 days.
• Programming skills: Strong proficiency in Go (Golang) and working proficiency in Python, with experience designing, developing, testing and operating production‑grade services.
• Event‑driven systems: Hands‑on experience building and operating event‑driven or message‑based architectures using technologies such as NATS, Kafka, or similar platforms. Knowledge of message contracts, idempotent consumers, replay, back‑pressure and reliable event delivery is important.
• CI/CD engineering: Practical experience developing and maintaining CI/CD pipeline tooling, including jobs, reusable templates, and runners. Experience managing GitLab CI at scale is a strong advantage.
• Application security: Strong working knowledge of web application security and the OWASP Top 10, with the ability to identify vulnerabilities in real code, implement fixes and develop automated checks to prevent recurrence.
• Security scanning tools: Hands‑on experience with SAST, SCA, and secret‑scanning solutions such as Semgrep, CodeQL, Snyk, Trivy, Grype, or Gitleaks. The ability to tune these tools to deliver actionable findings while minimizing false positives is essential.
• Cloud‑native technologies: Working knowledge of AWS and Kubernetes as deployment environments, including experience building, deploying, and operating secure services in cloud infrastructure.
• AI‑assisted engineering: Demonstrated practical use of AI development tools such as Claude Code, Codex, Cursor, or custom large language model integrations. Experience building reusable, AI‑powered workflows adopted by other engineers is particularly valuable.
• Security automation: Ability to translate manual security activities into reliable, scalable workflows that improve finding validation, remediation, verification and reporting.
• Preferred industry experience: Experience in fintech, payments, buy now, pay later (BNPL), consumer lending or other regulated environments is an advantage.
• Compliance awareness: Familiarity with PCI DSS and SOC 2 requirements as they relate to software development, change management, security controls, and audit evidence.
• Software supply‑chain security: Knowledge of software bill of materials (SBOM) pipelines, dependency governance, artifact signing, and provenance technologies such as Sigstore and SLSA is beneficial.
• Policy‑as‑code: Familiarity with policy‑as‑code and admission‑control tools such as Open Policy Agent (OPA), Kyverno, or Conftest is a plus.
• Security assessment experience: Exposure to bug bounty reports, external vulnerability triage or system‑level threat modeling is desirable.
• Engineering mindset: Strong analytical and problem‑solving skills, a commitment to code quality, and the ability to design solutions that prevent entire classes of vulnerabilities rather than addressing isolated findings.
• Ownership and execution: A proactive approach to delivering results, resolving issues permanently, and maintaining high engineering standards while making pragmatic, timely decisions.
• Communication and teamwork: Ability to collaborate effectively with multidisciplinary teams, challenge technical decisions constructively, communicate clearly and balance security objectives with business needs.
• Education: A bachelor's degree in Computer Science, Computer Engineering, or a related technical discipline is expected.

Benefits

• Competitive compensation: Gross monthly salary ranging from $5,000 to $9,500 USD, depending on experience, technical expertise, and expected contribution.
• Fully remote work: Work remotely from a location permitted by the employment arrangement, with the flexibility to work where you are most productive.
• High‑impact engineering: Build and own security platform services that help protect production systems and improve security across the software development lifecycle.
• Modern technology stack: Work with Go, Python, AWS, Kubernetes, NATS, GitLab CI, MySQL, PostgreSQL, and Elasticsearch.
• AI‑driven development: Opportunities to build and use AI‑assisted engineering workflows that improve code reviews, vulnerability triage, remediation, and developer productivity.
• Technical autonomy: Take ownership of meaningful engineering projects, make architectural decisions and drive improvements from design through production operation.
• Collaborative engineering culture: Work alongside specialists in security, detection and response, networking, and infrastructure engineering.
• Continuous learning: Develop expertise in cloud‑native architecture, application security, event‑driven systems, CI/CD automation and emerging AI technologies.
• Quality‑focused environment: Contribute to a culture that values automated testing, maintainable code, open‑source technologies, practical innovation and continuous improvement.
• Meaningful impact: Help establish scalable security practices that reduce recurring vulnerabilities and enable engineering teams to deliver software safely and efficiently.

How Jobgether Works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top‑fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice:

By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre‑contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

We may use artificial intelligence (AI) tools to support parts of the hiring process, such as reviewing applications, analyzing resumes, or assessing responses and identifying potential inconsistencies or verification signals in application materials based on available information. These tools assist our recruitment team but do not replace human judgment. Final hiring decisions are ultimately made by humans. If you would like more information about how your data is processed, please contact us.