**Work model:** **100% remote work model** **Position challenges:** Act as a technical reference and be responsible for defining, evaluating, and sustaining application security, secure development, and artificial intelligence (AI) processes at Conta Simples, working side by side with Engineering teams. The mission is to move from a reactive model to a structured AppSec \& AI Security program, vulnerability management, threat modeling, and code review, on a financial platform built in a distributed environment with microservices and a modern technology stack on Cloudflare, AWS, GCP. **Responsibilities and attributes****Your day-to-day at Conta Simples:** * Implement, sustain, and improve the secure development process (AppSec), integrating SAST, DAST, and SCA into the CI/CD pipeline with blocking criteria by criticality (security gate). * Responsible for the end-to-end vulnerability management program: triage, prioritization by impact, SLA definition, and follow-up on corrections with developers. * Execute Ethical Hacking Tests (EHT) and penetration tests (web/API and mobile pentest) to diagnose application vulnerabilities and support the correction of found flaws. * Develop and execute threat modeling (STRIDE) in critical flows and integrations with third-party financial APIs, generating security requirements for design. * Perform source code review with a focus on security and guide best practices (input/output validation, authentication/authorization, secret management). * Lead the conduct of security assessments in architecture and the construction of secure platforms with expertise in identifying technical and business rule vulnerabilities, acting as an enabler and not a blocker *(Security by Design)* * Lead a Security Champions program and awareness actions for developers. Develop technical reports and evaluate Information Security controls and processes, aiming for continuous improvement and compliance with PCI\-DSS, BACEN, and LGPD. * **Requirements and qualifications****What we expect from you:** * **Solid experience** **in application security and/or offensive security**, working closely with development teams. * **Secure development / DevSecOps:** practical experience integrating SAST and DAST into CI/CD and conducting vulnerability management. * **Threat modeling:** experience with STRIDE and risk prioritization by probability and impact. * **SAST/DAST/SCA tools** (e.g., VeraCode, Checkmarx, SonarQube, Snyk, OWASP ZAP) and pentest tools (e.g., Burp Suite, Nmap, SemGrep, Trivy, and related open\-source). * **Frameworks:** OWASP ASVS, OWASP Top 10, OWASP LLM, MITRE ATT\&CK, NIST, CIS, SANS. * **Stack:** knowledge of modern JavaScript frameworks — Node.js with TypeScript and React (alignment with what Conta Simples uses). * **Soft skills:** entrepreneurial mindset (self\-starter), high energy, excellent verbal and written communication, teamwork, and synergy with developers. * **Education:** completed or ongoing higher education in Technology fields (Computer Science, Information Systems, Information Security, or related), not essential. **It will be a plus if you have:** * Engagement with the community (CTF, bug bounty, papers, and write\-ups). * Offensive certifications such as OSCP, OSWE, CEH, or equivalents (Hack The Box / TryHackMe, OSWE). * Proven previous experience in code review and hands-on secure development. * Knowledge of PCI\-DSS and BACEN resolutions 4\.658/4\.893 and banking regulations. * Experience in payment fintechs * Experience with artificial intelligence such as AI agents and MCP. **Additional information** **Take a look at (some of) the benefits of being a Simpler:** Health plan (national coverage) with no monthly fee or copayment for our \#Simplers and up to \+2 legal dependents Dental plan (national coverage) with no monthly fee or copayment for our \#Simplers and up to \+2 legal dependents Flex food on the Ifood Benefits card Home office assistance on the Ifood Benefits card Wellhub extended to legal dependents (children and spouses) Birthday\-off (so you can enjoy your day with those you love!) Partnership with Educational Institutions Zenklub (Mental Health) \- Mental health platform with 04 free therapy sessions per month for every Simpler Life insurance Extended parental leave (180 days maternity and 45 days paternity), also valid for adoptive mothers and fathers, with the same rules applied to non-adoptive parents Childcare assistance \- For children up to 1 year of age Onhappy (Travel) \- Travel benefit with exclusive discounts on hotels, tickets, and experiences for you to travel better and more Guapeco (Pet Health) \- Pet health partnership with special conditions for you to take care of your best friend, on an individual subscription model #### **Our mission** We are **Conta Simples**, a corporate expense management system that combines financial services and technology. We exist to **transform** and **empower** the financial journey of companies, **optimizing** people's time. #### **Check out some of our achievements** * We are among the **100 most promising fintechs** in the world according to **CB Insights** * **LinkedIn Top Startups 2023** we are overcoming challenges, generating interest, and attracting the best talents * For the **third time**, we are highlighted among the **100 Startups to Watch** by PEGN magazine, evidencing our innovation, market potential, business, and scalability * We are highlighted among the **50 Startups that change Brazil** (Exame), reflecting our influence in the entrepreneurship ecosystem * Second Brazilian startup to receive investment from **Y Combinator** * We are among the **21 Startups Emerging Giants**, by KPMG * In early 2024, we received a new round of **investments (Series B) of 200 million reais.** All these achievements were only possible because of our team. We believe in the potential of each Simpler and, together, we build a collaborative environment, with autonomy and plenty of room to grow and develop. **\#VemSerSimpler!**
João Silva
Indeed · HR
João Silva
Indeed · HR
