Application Security Specialist (Application Security/ AppSec)

Description

We are looking for a highly motivated and experienced **Application Security Specialist (AppSec)** to join our technology team. The professional will act as a focal point in security engineering, ensuring the adoption of *Secure by Design* practices and directly contributing to the identification, mitigation, and correction of vulnerabilities throughout the entire software development lifecycle. **Main Responsibilities** * **Secure Architecture \& Standards:** Define, apply, and evolve secure development guidelines, evaluating new solutions, APIs, and integrations to propose risk mitigation controls. * **Vulnerability Analysis:** Perform continuous analysis of code, web/mobile applications, and APIs, supporting developers in fixing flaws identified by Pentests and scanners. * **DevSecOps Culture:** Incorporate and automate security checks and controls within CI/CD pipelines and engineering processes. * **Data Protection \& Access:** Evaluate authentication, authorization, access control, encryption, and protection of critical corporate data requirements. * **Training \& Compliance:** Guide engineering teams in adopting *Secure Coding* and ensure adherence to internal security, governance, and compliance policies. **Requirements and Qualifications** * **Application Security \& Frameworks:** Solid experience in secure development (Web and Mobile), threat modeling, and the application of frameworks such as **OWASP Top 10**, **OWASP ASVS**, and **OWASP LLM**. * **Programming Languages:** Practical knowledge for reading, analyzing, and supporting the correction of vulnerabilities in **Python**, **JavaScript (Node.js, Express)**, **Java (Spring Boot)**, and **C\+\+**. * **Testing \& Security Tools:** Proficiency in **SAST**, **DAST**, and **SCA** analysis, with practical use of tools such as **Fortify**, **Sonar**, and security scanners. * **Authentication, IAM \& Cryptography:** Experience with **OAuth 2\.0**, **OIDC**, **JWT**, identity management (**IAM**), and data protection (**Encryption**, **Hashing**, **Key Vault**, **KMS**, **HSM**). * **DevSecOps, Containers \& Cloud:** Practice in integrating security into **CI/CD** pipelines, **DevSecOps** automation, cloud security, **Containers**, **Kubernetes**, and Infrastructure as Code (**IaC**). **MJV Benefits:** TotalPass\\Wellhub; ‍‍‍‍ Group life insurance; Meal/ Food voucher; Health and dental plan \- Bradesco; Training actions: lectures, forums, exchanges, and conversations regarding our business. We are constantly connected to learn more and together; +MJVer Program: internal referral program where you refer a colleague to work with us, and if that relationship is a match, you win a prize. Partnerships: want a discount? We have a group on Workplace where we announce partnerships with educational institutions, language schools, gyms, restaurants, products, and other services;