Staff Security Engineer – AppSec

• Define and implement application security strategies, including for applications using LLMs and generative AI
• Collaborate with development teams to integrate security from the beginning of the software development lifecycle
• Conduct architecture, code, and design reviews to identify vulnerabilities
• Define guardrails and standards for LLM applications, addressing prompt injection, insecure output handling, data leakage, excessive agency, and denial-of-wallet attacks
• Establish guidelines for the secure use of AI-assisted development tools
• Develop and promote security standards and best practices
• Provide technical guidance and security training
• Work with automated validation tools in CI/CD, including SAST, DAST, SCA, and secret scanning
• Monitor threat trends, including threats to AI systems, and update protection measures
• Develop solutions to complex security problems while balancing business needs and risks
• Hunt for threats in corporate and production environments
• Define security architecture standards with Engineering and Product teams
• Create architecture plans and technical roadmaps for migrating legacy systems
• Identify vulnerabilities, assess risks, and support attack prevention
• Participate in security incident analysis and response
• Train and raise awareness among development teams regarding best practices and the secure use of AI assistants

• Completed or ongoing bachelor's degree in Information Security, Computer Science, Information Systems, Software Engineering, or a related field
• Knowledge of common attack vectors
• Experience conducting threat modeling
• Experience with effective security mechanisms for APIs and mobile applications
• Knowledge of core cloud security services and concepts (AWS, Azure, or GCP)
• Familiarity with agile methodologies and cross-functional teams
• Familiarity with security risks in applications that use LLMs and generative AI, including the OWASP Top 10 for LLM Applications and MITRE ATLAS
• Ability to identify opportunities for improvement, new solutions, and alerts
• Influencing and negotiation skills
• Ability to work independently
• Concise, candid, and assertive communication
• Initiative to seek out or request information
• Ability to read and communicate in English
• Passion for learning in a dynamic environment
• Preferred qualifications: experience in incident response and root cause analysis; knowledge of financial requirements and regulations such as Bacen, PCI, and SOX; strong programming skills; experience with threat modeling and controls for production LLM applications; AI model API protection; policies and controls for enterprise generative AI tools; NIST AI RMF and ISO/IEC 42001

• Base salary
• Variable compensation package (profit sharing, long-term incentive plan, or commission), subject to role eligibility
• Health and dental insurance with copayments
• Verde Virtual Hospital: 24/7 telemedicine
• Prescription medication allowance
• Meal and/or food allowance – Pluxee
• Childcare assistance for children up to 5 years and 11 months old
• Assistance for employees with children with disabilities
• Life insurance
• Fuel allowance or commuting assistance
• Home office allowance for hybrid or remote contracts
• New-parent welcome kit
• SESC partnership
• Education benefit: Internal self-development platform (Studa and Stone Library)
• Acolhe360º – Free emotional support
• Quick massage and onsite medical clinic
• Optional benefits: Wellhub, TotalPass, Pet Club, Flash, Férias&Co, transportation voucher, Allya, and educational partnerships
• Stone positions are also available to people with disabilities