Penetration Tester - Offensive Security (Red Team)

Description

**We are looking for a new person to join our Tech team as a** **Penetration Tester \- Offensive Security (Red Team)** **!** Can you imagine being part of one of the largest restaurant technology companies in Brazil? We serve more than **19,000 customers** nationwide and are **leaders in cloud-based management software** for the foodservice industry! Moreover, we are one of iFood’s **Super Integrators**, delivering a complete solution — from **Point of Sale to Back Office**. Amazing, right? And there’s more: **iFood is our investor!** This means we are experiencing exponential and accelerated growth — therefore, we seek people who share our energy, our drive to innovate, and our ambition to revolutionize the food service market, growing alongside us!  **Responsibilities and Duties** **What will be part of your day-to-day** * Plan and execute intrusion tests within defined scopes autonomously: web applications, APIs, cloud infrastructure, and internal networks. * Build and maintain an internal continuous pentest program — cadence, rotating scope, and risk-based prioritization. * Produce high-quality technical and executive reports, including severity, business impact, and actionable recommendations. * Validate and deepen findings from external pentest providers, cloud posture tools, and internal scans. * Conduct security assessments on critical integrations and authentication flows before and after remediation. * Perform security testing on mobile applications and installers — mapping attack surfaces not covered by automated tools. * Execute social engineering and targeted phishing exercises, contributing to our security awareness and culture program. * Monitor the remediation lifecycle — verifying the effectiveness of implemented fixes through structured retests. **Requirements and Qualifications** **What we expect from you** * Solid experience conducting intrusion tests on web applications and APIs: OWASP Top 10, OWASP API Security Top 10, business logic, and authentication and authorization flows. * Practical knowledge of AWS cloud security: IAM privilege escalation, S3 misconfiguration, Lambda, assumable roles, and policy analysis. * Proficiency with pentest tools: Burp Suite Pro, Metasploit, Nmap, Nuclei, and cloud enumeration tools such as Pacu and ScoutSuite. * Ability to write custom PoCs and exploitation scripts when available tools do not cover the scenario. * Experience conducting tests on mobile and thick-client applications, including communication analysis, local storage, and client-side attack surfaces. * Knowledge of social engineering techniques and ability to structure targeted phishing simulations with clear scope criteria and metrics. * Production of high-quality technical reports — with detailed reproduction steps, impact context, and actionable recommendations that teams can implement. * Genuine methodological autonomy: define scope, prioritize by risk, and document reasoning without relying on external checklists. * Critical thinking and adversarial mindset. * Independence and methodological autonomy. * Proactivity: anticipation of attack surfaces. * Risk communication for both technical and non-technical audiences. * Ethics and professional responsibility. * Collaboration with defense teams. * Follow-through: delivery quality and closure of findings. **What will set you apart here** * Experience with security testing in CI/CD pipelines and build environments. * Familiarity with static analysis and binary reverse engineering for evaluating installers and desktop clients. * Knowledge of lateral movement and persistence techniques in cloud and hybrid environments. * Experience with purple teaming — collaborative work with blue teams to validate detection and response capabilities. * Familiarity with threat intelligence frameworks and MITRE ATT\&CK TTPs applied to test planning. * Basic knowledge of serverless and container security. **Certifications \- Preferred** **** * OSCP \- Offensive Security Certified Professional * OSWE \- Offensive Security Web Expert * BSCP \- Burp Suite Certified Practitioner * eWPTX \- eLearnSecurity Web Application Penetration Tester eXtreme **Additional Information** **Liked it? Calm down — there’s more!** Here, you’ll also enjoy: **PJ Contract** with **30 paid days of rest** **Health insurance with 100% company-paid monthly fee** *(for PJ after 6 months)* **Dental insurance** *(for PJ after 6 months)* **Life insurance** **** **Complete equipment kit** **Home Office Allowance \-** R$180.00/month **Birthday Day Off** **Gympass discount** **No dress code** — be yourself! **Extended maternity and paternity leave** We are a SaaS technology company and **Brazil’s leader in food service management**. More than just software, we are strategic partners to over **15,000 establishments**, helping each business optimize processes, reduce costs, and increase sales. **We’re passionate about simplifying life for those living the daily reality of restaurants — and we do so through agility, intelligence, and education!** We operate **comprehensively**, integrating management needs into a single platform and accelerating the digital transformation of restaurants, bars, and delivery services across the country. We are **invested by iFood** and growing rapidly, empowering thousands of operations. Here, you’ll find a team passionate about technology, autonomy, and innovation — with real impact on our customers’ daily lives. If you seek **challenges**, **growth**, and the opportunity to help **build something great**, **Saipos** is **your place!**