[Hiring] Staff Platform Security Engineer @Grupo QuintoAndar

Role Description

Join QuintoAndar’s core engineering team to focus on building and evolving our security platform. As a Software Engineer on the Platform Security team, you’ll play a key role in designing, developing, and maintaining scalable, user-friendly tools and automations that enable our software engineers to build and deliver products quickly and securely.

Key Responsibilities

• Security Strategy and Architecture
  • Define and refine the platform’s security strategy, aligning it with business objectives and compliance requirements.
  • Design and lead the practical implementation of resilient security architectures for critical systems in cloud-native environments.
  • Establish security engineering standards through code, particularly for infrastructure as code (Terraform), containers, CI/CD pipelines, gates, and guardrails.
  • Conduct threat modeling and security design reviews for systems and new platform features.
• Development and Automation
  • Develop and maintain security platforms, automation tools, libraries, and reusable internal frameworks for the entire organization.
  • Integrate security throughout the entire development cycle (shift-left and Security by Default), implementing secure CI/CD pipelines with automated testing (SAST, DAST, SCA) and remediation tools.
  • Use technologies such as Terraform, Go, and Python to enhance security maturity by developing and deploying tools and platforms, effectively and scalably ensuring multi-layered security (software development, applications, and infrastructure).
• Operations, Governance, and Technical Leadership
  • Act as a technical security expert for the engineering teams, mentoring other engineers on secure development practices and DevSecOps.
  • Actively participate in incident response and security post-mortems.
  • Collaborate with SRE, Software Engineering, and Product teams to influence architectural decisions, taking into account the trade-offs between security, performance, and usability.

Qualifications

• Over 6 years of experience in software development and information security, with a focus on platforms.
• Solid experience with cloud providers (AWS, GCP, or Azure) and their respective security services.
• Proven proficiency in programming languages such as Python or Go for automation and tool development. Java is a plus.
• Proficiency in Infrastructure as Code (IaC), particularly with Terraform.
• Proficiency in DevSecOps practices and hands-on experience integrating security into CI/CD pipelines.
• In-depth knowledge of container security and orchestration (Kubernetes).
• Ability to solve complex and systemic problems, and excellent verbal and written communication skills.

Desirable Qualifications

• Knowledge of software architecture, microservices, and APIs.
• Familiarity with compliance frameworks such as SOC 2, ISO 27001, and LGPD/GDPR.
• Experience with threat modeling frameworks such as MITRE ATT&CK.
• Knowledge of programming languages, preferably Go, Python, and Java.
• Advanced or fluent English.

Benefits

• Competitive salary
• Profit sharing
• Meal allowance
• Health insurance
• Dental plan
• Life insurance
• Childcare subsidy and Atypical Parenthood subsidy
• Wellhub
• Home office allowance
• Employee assistance program (mental health, social, legal, and financial support)
• Extended parental leave
• Day off on birthday, Mother’s Day, and Father’s Day
• Benefits Club (discounts on everyday services)
• Discounts at educational institutions
• Reading kit for children – PlayKids