Lead Engineer – AppSec

• Serve as the technical security authority for Product and Engineering teams, integrating security early in the development lifecycle
• Lead threat modeling sessions for new features and architectural changes
• Conduct security code reviews and manual testing of web applications, APIs, and mobile applications
• Implement, maintain, and tune SAST, DAST, SCA, and secret detection tools in CI/CD pipelines
• Triage, prioritize, and track vulnerabilities, supporting developers with remediation
• Define secure development standards and guidelines covering authentication, authorization, encryption, and personal data
• Promote a security culture through training
• Support LGPD, ISO 27001, and SOC 2 compliance initiatives
• Participate in incident response involving applications
• Assess the current application security landscape, tools, vulnerability backlog, and product risks across Gupy
• Enhance SAST, SCA, and secret detection in pipelines for critical repositories, reducing false positives
• Implement triage and prioritization workflows with SLAs and remediation metrics
• Incorporate threat modeling into the development of higher-risk features
• Publish security standards and checklists for Engineering
• Conduct or coordinate penetration tests for critical applications and APIs, with remediation plans agreed upon with the teams

• Strong experience in application security or software development with a significant focus on security
• In-depth knowledge of the OWASP Top 10 and OWASP API Security Top 10
• Knowledge of injection vulnerabilities, XSS, IDOR, SSRF, authentication failures, and access control issues
• Ability to read and review code, preferably JavaScript/TypeScript (Node.js)
• Hands-on experience with Burp Suite, OWASP ZAP, Semgrep, SonarQube, Snyk, or similar tools
• Experience integrating security checks into CI/CD pipelines, such as GitHub Actions and Jenkins
• Knowledge of OAuth 2.0, OpenID Connect, and JWT
• Experience with vulnerability management, triage, criticality-based prioritization, and remediation tracking
• Strong communication skills, with the ability to translate technical risks into business impact and build partnerships with Engineering teams
• Preferred: experience with AWS, container security, and Kubernetes
• Preferred: knowledge of Terraform for infrastructure-as-code security
• Preferred: experience with threat modeling in microservices architectures
• Preferred: OSCP, OSWE, CSSLP, or equivalent certifications
• Preferred: knowledge of LGPD, ISO 27001, and SOC 2
• Preferred: experience at SaaS companies handling large volumes of personal data

• Meal allowance on a Caju card
• Medical plan fully funded by Gupy for you, with copayments for eligible dependents
• Dental plan
• Life insurance
• Home office allowance
• Physical wellness support through Wellhub and TotalPass
• Starbem, an online telemedicine and wellness service, including an initial complimentary offer of four psychology sessions, one nutrition session, and medical consultations
• Guapeco, a pet health plan with reimbursement at any veterinary clinic in Brazil
• Six months of maternity leave
• Extended paternity leave
• Parental leave policy applicable to same-sex couples, non-gestational mothers, and adoption cases
• Five days of marriage leave
• Internal recognition through Gupy Coins, redeemable as credit on a Caju card
• Birthday day off
• Creditas payroll-deducted loan
• Creditas financial education
• Creditas Store
• Férias&Co, providing annual travel credits with part of the monthly fee subsidized
• Opportunity to become a Gupy shareholder
• Career paths with management and technical-track options
• Learning, challenging assignments, and promotion opportunities