Senior Security – QA Lead

• Design and lead adversarial security testing of the deterministic decision path
• Attempt to defeat default-DENY, escalate privileges, or cross tenant boundaries, and prove that the boundaries hold
• Test multi-tenant isolation and owner-versus-customer scoping through the platform’s roster subsystem using real tenant-scoped identities
• Verify the tamper-resistance of the hash-chained audit trail, including append-only behavior, hash-chain linkage, and detection of attempted mutation
• Validate authentication and authorization across tenant and operator roles
• Review and extend the existing per-module freeze-audit self-tests
• Ensure every governance rule resolves through the live intake path to a real engine record
• Rank findings by severity and provide clear reproduction steps in GitHub Issues
• Keep findings in the same line of sight as the freeze-audit CI gate
• Uphold the merge gate: nothing lands unless freeze-audit CI is green
• Partner with the client on architectural sign-off for governance-core changes
• Report to the Ubiminds Engagement Manager
• Deliver a documented adversarial test suite, independent audit-chain verification, severity-ranked findings, and a clean green-CI defect flow within the first 12 weeks

• Strong security-testing background, including penetration testing, authorization/access-control testing, or security QA against systems where boundary failure is the primary risk
• Hands-on experience with Python and comfort reading a real codebase to design tests against it
• Experience with multi-tenant SaaS and practical understanding of tenant isolation failure modes
• Practical understanding of cryptographic audit trails / hash chaining and how tamper-evidence is proven
• Experience with Docker and CI-based workflows, including GitHub Actions or equivalent
• Ability to work against a green-CI merge gate
• Proficiency with Postgres for validating durable state and persistence
• Clear written English
• Strong ability to produce rigorous, reproducible defect reports
• Experience testing policy engines, authorization systems, or agentic-AI guardrails
• Exposure to SOC 2 controls and evidence expectations
• Familiarity with Render or comparable container hosting
• Background working in a regulated or safety-critical domain

• Placed in a product-based company and treated like a full-time team member
• Full back-office support: career guidance, HR, and concierge services
• Remote-first policy
• Company-provided MacBook (no BYOD)
• Tech talks, chapter meetings, and access to a strong community of top engineers
• Free English lessons with a native English speaker
• Referral bonus for recommending new Ubiminders
• Access to the Florianópolis HQ with snacks, massages, drinks, and games