[Hiring] Application Security Engineer @ABC Financial Services

Role Description

As an Application Security Engineer II, you will partner with software engineering teams to embed security throughout the software development lifecycle. You will help developers build secure applications by helping integrate security into CI/CD pipelines, improving code practices, implementing application security tooling, and supporting cloud-native security across AWS and Azure environments. This role is ideal for someone with a background in software engineering, DevSecOps, cloud engineering or application security who enjoys solving security challenges through collaboration, automation, and engineering rather than offensive security testing.

What You'll Do

• Partner with software engineering teams to identify, prioritize, and help remediate application security risks throughout the Secure Software Development Lifecycle (SSDLC).
• Implement and maintain application security tooling including SAST, DAST, Software Composition Analysis (SCA), and secret scanning within CI/CD pipelines to enable secure software delivery.
• Support secure code reviews, provide secure coding guidance, and help development teams remediate identified vulnerabilities.
• Review penetration testing findings and work with engineering teams to prioritize, validate, and remediate identified issues.
• Contribute to security automation, reusable security controls, and developer enablement resources to improve secure software delivery.
• Collaborate with DevOps teams to integrate security into CI/CD pipelines and Infrastructure as Code (IaC) workflows.
• Assist with application security reviews for applications deployed in AWS and Azure cloud environments, including cloud-native services, APIs, and containerized workloads.
• Assist in evaluating emerging technologies, including AI-enabled applications and Large Language Models (LLMs), for potential security risks.
• Contribute to application security governance activities by contributing to secure coding standards, technical guidance, and security documentation.
• Assist in maintaining security monitoring, logging, and vulnerability reporting processes in collaboration with cloud operations and security teams.
• Collaborate with Privacy, Compliance, Legal, and IT teams on initiatives related to data protection, regulatory compliance, and application security.
• Stay informed on emerging application security threats, vulnerabilities, and industry best practices and contribute to continuous improvement initiatives.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent work experience.
• Professional proficiency in both Portuguese and English (written and verbal) is required.
• 1–5 years of experience in Application Security, Software Engineering, DevSecOps, Platform Engineering or Cloud Engineering.
• Experience applying security throughout the Secure Software Development Lifecycle (SSDLC), including secure design, code review, automated security testing, and vulnerability remediation.
• Familiarity with application security testing methodologies, including SAST, DAST, Software Composition Analysis (SCA), vulnerability assessments, and basic penetration testing concepts.
• Familiarity of threat modelling methodologies such as OWASP ASVS and STRIDE.
• Basic understanding of AWS and/or Azure cloud security concepts and cloud-native application security.
• Familiarity with CI/CD pipelines and integrating security tools using platforms such as GitHub Actions, Azure DevOps, GitLab CI, Jenkins or similar.
• Experience developing software or the ability to read, understand, and troubleshoot code in one or more modern programming languages (Java, C#, Python, JavaScript/TypeScript, Go, etc.).
• Excellent analytical, problem-solving, and communication skills, with the ability to work collaboratively across cross-functional teams.
• Relevant industry certifications such as Security+, SSCP, CSSLP Associate, Azure Security Engineer Associate, AWS Security Specialty, or similar certifications are considered an asset.

Requirements

• Experience supporting developer security training or security champion programs.
• Experience with Infrastructure as Code (Terraform, CloudFormation, Bicep).
• Experience with container security (Docker, Kubernetes).
• Familiarity with OWASP Top 10, OWASP ASVS, CWE, and threat modeling methodologies.
• Experience securing AI-enabled applications or Large Language Model (LLM) integrations.
• Contributions to open-source projects or security automation initiatives.
• Familiarity with security and privacy standards such as LGPD, GDPR, PCI DSS, or ISO 27001 is desirable.
• Understanding modern authentication and API security concepts (OAuth 2.0, OpenID Connect, JWT, REST API security) is desirable.
• Familiarity with Kubernetes, containers, and container security concepts is desirable.

Benefits

• A purpose-driven company committed to helping change people's lives through technology, with a values-based culture focused on Better Life (#bestlife), One Team (#oneteam), and Growth Mindset (#growthmindset).
• 4 Days Off - once a quarter, we take a collective break and enjoy a day off together around the world. #oneteam.
• Health, dental, and life insurance plans.
• Meal allowance - to be used in supermarkets and restaurants.
• Home office allowance - you may need help with your internet bills.
• Gym access subscription app.
• Educational partnership with great discounts at universities, English schools, and more.
• Payroll-deducted loan - payment directly from your salary.
• EAP - providing psychological, legal, and financial assistance when you need it. Always.
• Access discounts with our partners, such as Dell, Microsoft, and many others.
• And more! - so many benefits we couldn't even list them all here!