Senior Product Security Engineer

About the role

We're looking for a Senior Product Security Engineer to partner closely with engineering teams and help build secure products from the ground up. In this role, you'll work alongside product and platform engineers to embed security throughout the Software Development Life Cycle (SDLC), ensuring security is a natural part of development rather than an afterthought. You'll lead architecture reviews, perform hands-on security testing, guide secure development practices, and help create a culture where developers can confidently ship secure software.

Required Skills

• Proven experience in Product Security or Application Security with a demonstrated impact on improving product security.
• Strong hands-on penetration testing experience for web applications and APIs.
• Deep understanding of modern web application architecture, including SPAs, APIs, authentication and authorization (OAuth 2.0/OpenID Connect), session management, and common attack vectors such as the OWASP Top 10.
• Experience conducting security architecture reviews and threat modeling.
• Strong knowledge of secure software development practices and integrating security throughout the SDLC.
• Experience performing secure code reviews and establishing secure coding standards.
• Hands-on experience operating and tuning SAST, DAST, and dependency/supply chain security scanning tools.
• Ability to triage security findings and translate them into actionable remediation plans.
• Excellent communication skills with the ability to collaborate effectively with software engineers and explain security risks in practical terms.
• Experience supporting security compliance initiatives such as SOC 2, ISO 27001, or similar frameworks.

Bonus Skills

• Experience with open-source security tools such as OWASP ZAP, Burp Suite Community Edition, Semgrep, Trivy, Grype, or Nuclei.
• Offensive security certifications such as OSCP.
• Cloud security experience across AWS, Azure, or Google Cloud Platform.
• Experience securing containerized environments and Kubernetes.
• Background working in enterprise or highly regulated environments.
• Experience improving developer security education and fostering secure engineering practices.

Offer Details

• Remote
• Full-time dedication (40 hours/week)

Location: Brazil only

Important note: Due to the high volume of applications, we are unable to provide individual feedback at this stage. Only candidates shortlisted for the next steps will be contacted by our team.