Lead Engineer – AppSec

Job not on LinkedIn

🔥 0 minutes ago

🇧🇷 Brazil – Remote

⏰ Full Time

🟠 Senior

🧑‍💻 Full-stack Engineer

👻 Ghost score 22%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Chicago Career Tech

WebsiteLinkedInAll Job Openings

11 - 50 employees

📚 Education

Education

Chicago Career Tech is a Chicago-based organization focused on career and technical education (CTE) and workforce development. Based on the company name and typical usage of “Career Tech,” it likely provides vocational training, short-term workforce programs, and career readiness services aimed at preparing learners for in-demand jobs in the Chicago area. The provided text contained only LinkedIn boilerplate, so this description relies on the organization name and common sector practice — please verify specific services directly with the company.

📋 Description

• Serve as the technical security authority for Product and Engineering teams, integrating security early in the development lifecycle • Lead threat modeling sessions for new features and architectural changes • Conduct security code reviews and manual testing of web applications, APIs, and mobile applications • Implement, maintain, and tune SAST, DAST, SCA, and secret detection tools in CI/CD pipelines • Triage, prioritize, and track vulnerabilities, supporting developers with remediation • Define secure development standards and guidelines covering authentication, authorization, encryption, and personal data • Promote a security culture through training • Support LGPD, ISO 27001, and SOC 2 compliance initiatives • Participate in incident response involving applications • Assess the current application security landscape, tools, vulnerability backlog, and product risks across Gupy • Enhance SAST, SCA, and secret detection in pipelines for critical repositories, reducing false positives • Implement triage and prioritization workflows with SLAs and remediation metrics • Incorporate threat modeling into the development of higher-risk features • Publish security standards and checklists for Engineering • Conduct or coordinate penetration tests for critical applications and APIs, with remediation plans agreed upon with the teams

🎯 Requirements

• Strong experience in application security or software development with a significant focus on security • In-depth knowledge of the OWASP Top 10 and OWASP API Security Top 10 • Knowledge of injection vulnerabilities, XSS, IDOR, SSRF, authentication failures, and access control issues • Ability to read and review code, preferably JavaScript/TypeScript (Node.js) • Hands-on experience with Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, or similar tools • Experience integrating security checks into CI/CD pipelines, such as GitHub Actions and Jenkins • Knowledge of OAuth 2.0, OpenID Connect, and JWT • Experience with vulnerability management, triage, criticality-based prioritization, and remediation tracking • Strong communication skills, with the ability to translate technical risks into business impact and build partnerships with Engineering teams • Preferred: experience with AWS, container security, and Kubernetes • Preferred: knowledge of Terraform for infrastructure-as-code security • Preferred: experience with threat modeling in microservices architectures • Preferred: OSCP, OSWE, CSSLP, or equivalent certifications • Preferred: knowledge of LGPD, ISO 27001, and SOC 2 • Preferred: experience at SaaS companies handling large volumes of personal data

🏖️ Benefits

• Meal allowance on a Caju card • Medical plan fully funded by Gupy for you, with copayments for eligible dependents • Dental plan • Life insurance • Home office allowance • Physical wellness support through Wellhub and TotalPass • Starbem, an online telemedicine and wellness service, including an initial complimentary offer of four psychology sessions, one nutrition session, and medical consultations • Guapeco, a pet health plan with reimbursement at any veterinary clinic in Brazil • Six months of maternity leave • Extended paternity leave • Parental leave policy applicable to same-sex couples, non-gestational mothers, and adoption cases • Five days of marriage leave • Internal recognition through Gupy Coins, redeemable as credit on a Caju card • Birthday day off • Creditas payroll-deducted loan • Creditas financial education • Creditas Store • Férias&Co, providing annual travel credits with part of the monthly fee subsidized • Opportunity to become a Gupy shareholder • Career paths with management and technical-track options • Learning, challenging assignments, and promotion opportunities