Staff DevSecOps

VTEX; Brasil; Presencial; USD 60.000 - 90.000; Tempo integral

Resumo da oferta

VTEX seeks a Staff Security Engineer - DevSecOps to enhance platform security effectively without hindering progress. In this hands-on role, you'll implement secure development practices and collaborate with teams to manage vulnerabilities, ensuring robust cloud infrastructure and security measures are in place.

Serviços

Annual profit-sharing program

Health, dental, and life insurance

Flexible work schedule

Wellness program

Qualificações

• Strong background in software engineering or related fields.
• Experience in cloud-native environments like AWS and Kubernetes.
• Practical knowledge of security tooling and practices.

Responsabilidades

• Design and maintain secure pipelines and guardrails.
• Lead threat modeling and architectural reviews.
• Identify and remediate vulnerabilities in code and infrastructure.

Conhecimentos

Threat modeling

Secure architecture

Vulnerability remediation

Risk assessment

Cloud Security

Communication

Ferramentas

SAST

IaC scanning

CSPM

Descrição da oferta de emprego

We’re looking for a Staff Security Engineer - DevSecOps to help us scale platform security — without slowing anyone down. You’ll focus on makingAppSec and CloudSec part of how we build - not something bolted on later.This is a hands-on, high-impact role where you’ll design and embed secure-by-default practices across the SDLC and our cloud-native infrastructure, while working closely with Detection Engineering, Red Team, and platform teams.You’ll be a technical reference for secure architecture, lead and support vulnerability remediation, and drive initiatives that reduce our attack surface without blocking innovation.This is not a compliance role — it’s a core engineering function embedded in our platform strategy.

Key Responsibilities

• Design and maintain secure-by-default pipelines, IaC modules, and developer guardrails
• Lead architectural reviews and threat modeling for platform-critical services
• Identify and drive remediation of vulnerabilities across code, CI/CD, and cloud
• Own security posture for core cloud infrastructure (CSPM, least privilege, K8s runtime protection)
• Collaborate with Detection Engineering on threat-informed defense (e.g. logging, alerting, detections)
• Act as AppSec and CloudSec technical lead on cross-functional engineering projects
• Contribute to tooling strategy for SAST, secrets management, IaC scanning, and CSPM
• Partner with engineering and DevOps to evolve secure paved roads and templates
• Guide internal security champions and mentor other engineers across the org
• Support post-incident forensics and validate fixes through regression testing

About the team

The VTEX InfoSec team is a dynamic and collaborative group dedicated to ensuring the highest standards of digital security across the platform. The team works closely with various internal departments to proactively identify and address potential security risks, ensuring that both the company's infrastructure and customer data are well protected. The InfoSec team is known for its problem-solving skills, attention to detail, and ability to work cross-functionally, making security a top priority for VTEX and its clients.

Who you are

Must-Have

• Solid background as a software engineer, platform engineer, or SRE
• Experience building or securing production systems in cloud-native environments (AWS, Kubernetes, Terraform)
• Familiarity with threat modeling, secure architecture, and modern attack surfaces
• Practical experience with security tooling: SAST, secrets scanning, IaC scanning
• Able to reason about risk, prioritize what matters, and help teams fix the right things, fast
• Comfortable navigating codebases, CI/CD pipelines, and infrastructure stacks
• Strong written and async communication — docs, reviews, design feedback

Nice to Have

• Experience collaborating with Detection/Blue Team or Red Team
• Worked on developer platforms, paved roads, or internal tooling
• Understanding of the software supply chain and related security controls
• Experience improving SDLC security through automation and integration

Bonus Points

• Contributions to security or platform open-source tooling
• Participated in purple teaming, incident retrospectives, or forensics
• Familiarity with CSPM, runtime cloud security, or cloud IAM hardening
• You’ve been the security person on an engineering team — or the engineer on a security team

ABOUT VTEX

VTEX (NYSE: VTEX) is the composable and complete commerce platform that delivers more efficiency and less maintenance to organizations seeking to make smarter IT investments and modernize their tech stack. Through our pragmatic composability approach, we empower brands, distributors, and retailers with unparalleled flexibility and comprehensive solutions, enabling them to invest solely in what provides a clear business advantage and boosts profitability. VTEX is trusted by 2,600 global B2C and B2B clients, including Carrefour, Colgate, Motorola, Sony, Stanley Black & Decker, and Whirlpool, having 3,500 active online stores across 43 countries (as of FY ended on December 31, 2023). For more information, visit www.vtex.com .

BENEFITS

• Annual profit-sharing program and equity eligibility
• Health, dental, and life insurance with national coverage provided by VTEX
• Flexible meal allowance
• Extended parental leaves
• Flexible work schedule and remote-first culture
• Financial assistance to build your work-from-home setup
• Wellness program
• Free shipping on 1000+ VTEX stores

Apply for this job

*

indicates a required field

First Name *

Last Name *

Preferred First Name

Email *

Phone *

Resume/CV

Enter manually

Accepted file types: pdf, doc, docx, txt, rtf

LinkedIn Profile *

Website

Do you have any special needs that we should be aware of in order to accommodate you during the recruitment process? Feel free to specify which one in affirmative case. *

Are you comfortable working in teams that primarily operate in English? * Select...

Do you have any family members currently working at VTEX? If so, please list their names and their positions. *

Do you have any close friends or relatives who are Public Officers? If so, please list their names and their position in their government agency. *

(A Public Officer stands for anyone who, even if transitionally, occasionally or without remuneration, holds a position, employment or public function in government bodies, state entities or diplomatic representations, as well as in legal entities controlled, directly or indirectly, by the government or in international public organizations.)

On Data Privacy * Select...

Privacy Notice
The personal data provided during this selection process will be collected and used exclusively for the purpose of evaluating and selecting candidates. By proceeding with your registration, you are aware of the collection, use, and storage of your personal data by VTEX. For further details on how your data will be processed, please visithttps://vtex.com/us-en/privacy-and-agreements/hiring-notice/ . You will find information on (i) how personal data is processed in VTEX selection processes; (ii) what types of data VTEX collects; (iii) your rights as a data subject; and (iv) how long VTEX processes your data. If you have any questions, please contact our DPO [e-mail] or request the exercise of your rights as a data subject athttps://vtex.com/us-en/data-request .

By applying for this position, the candidate acknowledges and explicitly affirms their understanding that the use of any form of artificial intelligence (AI) during the selection process is explicitly prohibited. * Select...