Job Summary: An Offensive Security Professional to perform penetration testing and Red Team activities, strengthening ALLOS's security posture. Key Highlights: 1. Conduct penetration testing and Red Team activities across diverse environments. 2. Assess the security of applications and infrastructure. 3. Collaborate to advance DevSecOps practices. ALLOS is a brand with a strong heritage—approximately 50 years of experience transforming the Brazilian market. We are a benchmark for excellence and innovation, delivering the quality and trust embedded in our history. Our new brand emerged ready for the future following the 2023 merger between Aliansce Sonae and brMalls. Yet this journey began long before. It all started with Aliansce, which inaugurated the first shopping center in Brazil’s Northeast region—and the second in the country—in 1975. In 2019, the merger between Aliansce and Sonae Sierra formed Aliansce Sonae, becoming the leader in shopping center management in Brazil, operating 32 properties. In 2006, brMalls was founded, resulting in a portfolio of 30 assets spanning all five regions of Brazil. Thus, in 2023, ALLOS emerged from the convergence of two national powerhouses in the sector, uniting forces to become the most innovative platform for entertainment, lifestyle, services, and shopping. Our story continues—and we’re ready to create transformative moments that impact people’s lives, fostering connections and opportunities. **Responsibilities and Duties** * Perform penetration tests (Pentest) on web applications, APIs, servers, networks, and internal environments. * Execute Red Team activities, simulating real-world attacks to identify vulnerabilities and security risks. * Conduct enumeration, exploitation, post-exploitation, lateral movement, and privilege escalation tests within controlled environments. * Assess application security using methodologies such as OWASP Top 10 and MITRE ATT&CK. * Identify, analyze, and prioritize vulnerabilities in systems, infrastructure, applications, and network assets. * Prepare technical and executive reports containing evidence of identified vulnerabilities, risk analysis, and remediation recommendations. * Perform retesting to validate the effectiveness of fixes implemented by responsible teams. * Support supplier and new solution security assessments prior to production deployment. * Collaborate with Infrastructure, Development, SOC, and Blue Team teams to discuss risks, guide remediation, and strengthen security controls. * Participate in advancing DevSecOps practices—including static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), exposed credentials detection (Secrets), and Infrastructure-as-Code (IaC) validation. * Utilize industry-standard tools such as Burp Suite, Nmap, Metasploit, BloodHound, Impacket, Qualys, Trivy, Snyk, Orca, or similar for activity execution. * Contribute to the continuous improvement of offensive security methodologies, processes, and tools. **Requirements and Qualifications** * Completed undergraduate degree; * Experience with penetration testing and Red Team activities; * Knowledge of networking, Active Directory, Windows, and Linux; * Experience in application security testing (OWASP Top 10); * Hands-on experience with tools such as Burp Suite, Nmap, Metasploit, BloodHound, Impacket, and vulnerability scanners; * Knowledge of DevSecOps practices (SAST, DAST, SCA, Secrets, and IaC); * Experience drafting technical vulnerability reports; * Analytical, investigative mindset with strong hands-on capability. **Preferred Qualifications**: * Experience in large-scale corporate environments; * Experience evaluating supplier security; * Knowledge of cloud environments (Azure, AWS, or GCP) and tools such as Orca; * Certifications such as eJPT, eCPPT, or OSCP; * Experience automating security testing. **Additional Information** What We Offer * Meal/food allowance; * Transportation allowance/parking; * Health insurance; * Dental insurance; * Life insurance; * Birthday day off; * Wellhub; * Wellz (corporate mental health program); * Saber Online (internal learning platform); * Annual bonus. **Work Location:** Vila Olímpia – São Paulo / SP **Work Schedule:** 5x2 We exist to connect people with what matters—serving and delighting everyone every day, creating transformative moments. In an ever-evolving world, we emerge as a powerful force of transformation—a legacy built on 50 years of experience that reshaped retail in Brazil and established a trajectory of excellence and trust, positioning us as a market benchmark with a portfolio of 51 shopping centers across all five regions of Brazil. Our shopping centers are vibrant destinations, full of opportunities for entrepreneurs and innovative brands. With over 15,000 stores attracting more than 51 million visits per month, we create welcoming, safe, and inspiring spaces where every visit becomes a journey of discovery and connection. We build physical and digital experiences that exceed consumer expectations and generate positive societal impact—with a long-term vision and sustainable outcomes for retailers and partners. Click here for more information about how ALLOS processes your personal data as a Candidate. **DIVERSITY, EQUITY AND INCLUSION** **ALLOS** is committed to creating and nurturing a diverse workplace—one that welcomes individuals of all races, ethnicities, genders, backgrounds, lived experiences, and profiles—prioritizing social inclusion, reducing inequalities, and implementing fair employment practices that promote equal opportunity. We expect all employees—regardless of role or hierarchy—to feel welcomed and guided by mutual respect. Our job openings are open to individuals from diverse groups, including women, Black people, LGBTQIAPN+, persons with disabilities, and other underrepresented groups. **Attention:** ALLOS **does not charge any fees at any stage of its selection processes.** Be cautious of job offers requesting payment for courses, fees, or materials.
João Silva
Indeed · HR
João Silva
Indeed · HR
