Senior Software Engineer, Security Platform

Job description

**This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Software Engineer, Security Platform based in Brazil** **.** As a Senior Software Engineer, Security Platform, you will design, build, and maintain the software infrastructure that powers modern security operations across cloud environments and applications. You will develop backend services, event-driven systems, and automated security controls that help engineering teams identify and resolve vulnerabilities efficiently. Working primarily with Go, Python, AWS, and Kubernetes, you will strengthen the reliability, scalability, and effectiveness of security tooling across the development lifecycle. You will also build intelligent, AI-assisted workflows that streamline vulnerability triage, code reviews, and remediation processes. Collaborating with security and engineering specialists, you will turn security requirements into practical, automated solutions that protect systems without slowing product delivery. This is an exciting opportunity for a hands-on engineer who enjoys solving complex technical challenges, taking ownership of production systems, and making security an integral part of software development. ### Accountabilities - Security platform engineering: Design, develop, deploy, and maintain security engineering services primarily in Go and Python, running on AWS and Kubernetes. Build new capabilities, improve existing services, strengthen reliability, and retire outdated components when appropriate. - Event-driven architecture: Own and enhance the messaging infrastructure connecting security services, including the NATS event bus, message contracts, consumers, delivery guarantees, replay mechanisms, back-pressure handling, and observability. - End-to-end security integrations: Connect security scanners, vulnerability management systems, ticketing platforms, and metrics dashboards to ensure findings are tracked from discovery through remediation, with clear ownership and reliable audit evidence. - CI/CD security controls: Build and maintain security gates across GitLab CI pipelines, covering static application security testing (SAST), software composition analysis (SCA), secret detection, container scanning, and infrastructure-as-code (IaC) scanning. - Security gate optimization: Select and configure scanning tools, tune detection rules, manage suppression workflows, reduce false positives, and develop rollout mechanisms that move controls from advisory reporting to enforcement without unnecessarily disrupting engineering delivery. - AI-assisted security workflows: Develop reusable AI-powered tools and agentic workflows, including automated code-review agents, vulnerability triage systems, verification processes, and remediation assistants that other engineers can adopt effectively. - Vulnerability triage and remediation: Validate security findings, confirm true positives, provide reproduction details and actionable remediation guidance, and automate the routing of issues to responsible engineering teams and vulnerability-management operations. - Secure software development: Apply practical web application security expertise to identify and fix vulnerabilities, incorporate security checks into development workflows, and prevent recurring vulnerability patterns across the engineering organization. - Threat modeling and secure design: Participate in threat modeling and security design reviews for the services, integrations, and development pipelines under your responsibility. - Operational reliability: Monitor and improve the performance, availability, and maintainability of security platform services, and participate in the on-call rotation for the systems you own. - Cross-functional collaboration: Partner with security, infrastructure, and software engineering teams to embed effective security controls into everyday development practices while maintaining speed, reliability, and developer productivity. - Continuous improvement: Apply automation, engineering best practices, and AI-assisted development techniques to improve platform efficiency, code quality, and the overall effectiveness of security operations. ## Requirements - Professional experience: At least 6 years of professional software engineering experience, including substantial backend development and hands-on responsibility for production systems. Candidates should demonstrate recent practical development experience, including significant production changes delivered within the past 30 days. - Programming skills: Strong proficiency in Go (Golang) and working proficiency in Python, with experience designing, developing, testing, and operating production-grade services. - Event-driven systems: Hands-on experience building and operating event-driven or message-based architectures using technologies such as NATS, Kafka, or similar platforms. Knowledge of message contracts, idempotent consumers, replay, back-pressure, and reliable event delivery is important. - CI/CD engineering: Practical experience developing and maintaining CI/CD pipeline tooling, including jobs, reusable templates, and runners. Experience managing GitLab CI at scale is a strong advantage. - Application security: Strong working knowledge of web application security and the OWASP Top 10, with the ability to identify vulnerabilities in real code, implement fixes, and develop automated checks to prevent recurrence. - Security scanning tools: Hands-on experience with SAST, SCA, and secret-scanning solutions such as Semgrep, CodeQL, Snyk, Trivy, Grype, or Gitleaks. The ability to tune these tools to deliver actionable findings while minimizing false positives is essential. - Cloud-native technologies: Working knowledge of AWS and Kubernetes as deployment environments, including experience building, deploying, and operating secure services in cloud infrastructure. - AI-assisted engineering: Demonstrated practical use of AI development tools such as Claude Code, Codex, Cursor, or custom large language model integrations. Experience building reusable, AI-powered workflows adopted by other engineers is particularly valuable. - Security automation: Ability to translate manual security activities into reliable, scalable workflows that improve finding validation, remediation, verification, and reporting. - Preferred industry experience: Experience in fintech, payments, buy now, pay later (BNPL), consumer lending, or other regulated environments is an advantage. - Compliance awareness: Familiarity with PCI DSS and SOC 2 requirements as they relate to software development, change management, security controls, and audit evidence. - Software supply-chain security: Knowledge of software bill of materials (SBOM) pipelines, dependency governance, artifact signing, and provenance technologies such as Sigstore and SLSA is beneficial. - Policy-as-code: Familiarity with policy-as-code and admission-control tools such as Open Policy Agent (OPA), Kyverno, or Conftest is a plus. - Security assessment experience: Exposure to bug bounty reports, external vulnerability triage, or system-level threat modeling is desirable. - Engineering mindset: Strong analytical and problem-solving skills, a commitment to code quality, and the ability to design solutions that prevent entire classes of vulnerabilities rather than addressing isolated findings. - Ownership and execution: A proactive approach to delivering results, resolving issues permanently, and maintaining high engineering standards while making pragmatic, timely decisions. - Communication and teamwork: Ability to collaborate effectively with multidisciplinary teams, challenge technical decisions constructively, communicate clearly, and balance security objectives with business needs. - Education: A bachelor's degree in Computer Science, Computer Engineering, or a related technical discipline is expected. ## Benefits - Competitive compensation: Gross monthly salary ranging from $5,000 to $9,500 USD, depending on experience, technical expertise, and expected contribution. - Fully remote work: Work remotely from a location permitted by the employment arrangement, with the flexibility to work where you are most productive. - High-impact engineering: Build and own security platform services that help protect production systems and improve security across the software development lifecycle. - Modern technology stack: Work with Go, Python, AWS, Kubernetes, NATS, GitLab CI, MySQL, PostgreSQL, and Elasticsearch. - AI-driven development: Opportunities to build and use AI-assisted engineering workflows that improve code reviews, vulnerability triage, remediation, and developer productivity. - Technical autonomy: Take ownership of meaningful engineering projects, make architectural decisions, and drive improvements from design through production operation. - Collaborative engineering culture: Work alongside specialists in security, detection and response, networking, and infrastructure engineering. - Continuous learning: Develop expertise in cloud-native architecture, application security, event-driven systems, CI/CD automation, and emerging AI technologies. - Quality-focused environment: Contribute to a culture that values automated testing, maintainable code, open-source technologies, practical innovation, and continuous improvement. - Meaningful impact: Help establish scalable security practices that reduce recurring vulnerabilities and enable engineering teams to deliver software safely and efficiently.a