Lead AppSec & Cloud Security Engineer (Remote Brazil)

Hidden Jobs; United States; Remote; USD 62,000 - 100,000; Full time

Benefits offered by this job

Health, dental, and life insurance

Wellness & mental health program

Home office stipend

Generous PTO and parental leave

Career growth & internal mobility

Job summary

Hidden Jobs is seeking a Staff Security Engineer to anchor its Application Security function. The role is remote within Brazil and sits inside an Information Security team that protects a large-scale consumer product.

The center of gravity is software security across the SDLC, while the mandate expands into incident response, threat intelligence, cloud security, and compliance. You will own multiple security domains end to end, define secure-by-design architectural standards, lead threat

Qualifications

• Extensive experience in security engineering or secure software design in cloud environments.
• Expert knowledge of threat modeling and secure coding standards.
• Willingness to support cloud security, GRC, or detection beyond AppSec priorities.
• Fluency in English and Portuguese for executives and product partners.
• Proven ability to balance long-term risk reduction with business velocity.

Responsibilities

• Own multiple security domains end to end as the technical authority.
• Define secure-by-design architectural standards and lead threat modeling.
• Drive cross-service incident response and post-mortems with engineering teams.
• Lead red team and pentest engagements and drive remediation with engineers.
• Set SLAs, SLOs, and KPIs for security posture and build monitoring.
• Partner with engineering, product, and legal leadership to align security with business priorities.

Skills

Security engineering

Cloud security

Threat modeling

Secure coding

Incident response

Job description

Hidden Jobs is seeking a Staff Security Engineer to anchor its Application Security function. The role is remote within Brazil and sits inside an Information Security team that protects a large-scale consumer product.

The center of gravity is software security across the SDLC, while the mandate expands into incident response, threat intelligence, cloud security, and compliance. You will own multiple security domains end to end, define secure-by-design architectural standards, lead threat