Security Engineer (DevSecOps / AppSec) in Brazil, Indiana at Jobgether

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer (DevSecOps / AppSec) based in Brazil.

This role offers the opportunity to strengthen application security practices within a fast-growing technology environment focused on innovation and cloud-based solutions.
The successful candidate will help build secure development processes by integrating security throughout the software lifecycle.
You will work closely with engineering teams to identify risks, improve security standards, and protect critical systems and customer data.
This position combines hands-on security engineering, automation, cloud security, and collaboration across development teams.
You will contribute to modern DevSecOps initiatives, from pipeline protection and threat modeling to infrastructure hardening and secure architecture reviews.
Working in a remote environment, you will have the autonomy to drive security improvements and share your expertise across teams.
This is an ideal opportunity for a security professional passionate about application protection, cloud technologies, and building secure software at scale.

• Implement and maintain security tools within CI/CD pipelines, including SAST, DAST, SCA, and secret scanning solutions across development workflows.
• Operate, maintain, and improve secrets management solutions such as Vault and cloud-based secret management platforms.
• Continuously monitor repositories for exposed secrets and collaborate with development teams to remediate security findings.
• Perform security-focused code reviews for critical features involving authentication, authorization, external integrations, and sensitive data handling.
• Strengthen infrastructure security by reviewing Terraform configurations, IAM policies, AWS environments, security groups, and cloud security practices.
• Support remediation efforts related to security assessments, penetration testing results, vulnerability scans, and internal findings.
• Develop and lead Security Champions programs by identifying security advocates within engineering teams and supporting continuous security education.
• Conduct threat modeling sessions for new features, integrations, and critical systems in partnership with product and engineering teams.
• Define and document security requirements throughout the software development lifecycle, from design through deployment.
• Evaluate the security of internal and external APIs, partner integrations, authentication flows, and application architectures.
• Create scripts and automation solutions to improve security analysis, monitoring, and remediation processes.
• Promote secure development practices and help engineering teams adopt security-first approaches.

• Hands-on experience with CI/CD pipelines and integrating security tools such as SAST, SCA, and secret scanning into development workflows.
• Strong knowledge of AWS security services and concepts, including IAM, S3, Lambda, Security Groups, VPC, KMS, and cloud security best practices.
• Experience with Infrastructure as Code (IaC), particularly Terraform, including identifying and fixing security issues in configurations.
• Strong understanding of OWASP Top 10 and OWASP API Security Top 10, with the ability to apply security principles during code reviews and architecture discussions.
• Ability to create scripts and automation workflows using languages such as Python or Bash.
• Experience reading and understanding application code in at least one programming language used within software products.
• Strong analytical thinking and risk assessment skills with the ability to identify and prioritize security concerns.
• Proactive mindset with strong ownership, initiative, and ability to work independently.
• Excellent communication skills and ability to collaborate effectively with software development teams.
• Ability to explain security concepts clearly and support knowledge sharing across teams.
• Experience with Bitbucket is considered an asset.
• Practical experience with secrets management tools such as HashiCorp Vault or AWS Secrets Manager is preferred.
• Familiarity with DAST tools such as OWASP ZAP or Burp Suite integrated into development pipelines is a plus.
• Knowledge of Docker container security, image repositories, CIS Benchmarks, and cloud posture management tools such as Wiz, Prisma Cloud, AWS Security Hub, or GuardDuty is beneficial.
• Experience securing serverless architectures, including Lambda and API Gateway, is an advantage.
• Relevant certifications such as AWS Solutions Architect, AWS Security Specialty, Certified DevSecOps Professional, or HashiCorp Vault Associate are considered a plus.

• Fully remote work environment with flexibility and autonomy.
• PJ contract model with 30 days of paid rest.
• Health insurance with company-paid monthly fees after 6 months for PJ contractors.
• Dental insurance after 6 months.
• Life insurance coverage.
• Complete equipment package provided for work.
• Home office allowance of R$180 per month.
• Birthday day off.
• Gym membership discounts.
• Flexible and inclusive workplace culture with no dress code.
• Extended maternity and paternity leave.
• Opportunity to work on impactful technology solutions within a rapidly growing environment.
• Collaborative culture focused on innovation, autonomy, and professional growth.