Application Security Engineer (Secure SDLC)
ABC Financial Services4 months ago
Remote, BrazilMid Level
Responsibilities
- Partner with software engineering teams to identify, prioritize, and remediate application security risks throughout the SSDLC.
- Implement and maintain SAST, DAST, SCA, and secret-scanning tools within CI/CD pipelines.
- Conduct secure code reviews, provide secure coding guidance, and support vulnerability remediation.
- Review penetration testing findings and help engineering teams validate and remediate issues.
- Develop security automation, reusable security controls, and developer enablement resources.
- Integrate security into CI/CD pipelines and Infrastructure as Code workflows with DevOps teams.
- Support application security reviews for AWS and Azure applications, APIs, and containerized workloads.
- Evaluate emerging technologies, including AI-enabled applications and LLMs, for security risks.
- Contribute to secure coding standards, technical guidance, security documentation, monitoring, logging, and vulnerability reporting.
- Collaborate with Privacy, Compliance, Legal, IT, cloud operations, and security teams on data protection and application security initiatives.
Requirements
- Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent work experience.
- Professional proficiency in Portuguese and English, written and verbal.
- 1–5 years of experience in Application Security, Software Engineering, DevSecOps, Platform Engineering, or Cloud Engineering.
- Experience applying security across the SSDLC, including secure design, code review, automated security testing, and vulnerability remediation.
- Familiarity with SAST, DAST, SCA, vulnerability assessments, and basic penetration testing concepts.
- Familiarity with threat modeling methodologies such as OWASP ASVS and STRIDE.
- Basic understanding of AWS and/or Azure cloud security and cloud-native application security.
- Familiarity with CI/CD security integrations using GitHub Actions, Azure DevOps, GitLab CI, Jenkins, or similar platforms.
- Experience developing software or reading and troubleshooting code in Java, C#, Python, JavaScript/TypeScript, Go, or another modern programming language.
- Strong analytical, problem-solving, communication, and cross-functional collaboration skills.
- Relevant certifications such as Security+, SSCP, CSSLP Associate, Azure Security Engineer Associate, or AWS Security Specialty are considered an asset.
- Experience with developer security training, security champion programs, Infrastructure as Code, container security, AI-enabled applications, LLM integrations, or security automation is desirable.
- Familiarity with OWASP Top 10, CWE, LGPD, GDPR, PCI DSS, ISO 27001, OAuth 2.0, OpenID Connect, JWT, and REST API security is desirable.
Benefits
- Values-based, purpose-driven culture focused on inclusion, collaboration, and professional growth.
- Four collective days off once per quarter.
- Health, dental, and life insurance plans.
- Meal allowance for supermarkets and restaurants.
- Home office allowance for internet expenses.
- Gym access subscription app.
- Educational discounts at universities, English schools, and other institutions.
- Payroll-deducted loan and psychological, legal, and financial assistance through the EAP.
- Partner discounts, including Dell and Microsoft.
- Remote role, indicated by the #LI-REMOTE listing marker.
Tech Stack
AWSAzureC#DockerGitHub ActionsGitLab CI/CDGoJavaJavaScriptJenkinsKubernetesPythonTerraformTypeScript
Categories
About ABC Financial Services
ABC Financial Services (now ABC Fitness) builds club management and billing software for gyms, studios, and health clubs, combining SaaS tools with integrated payment processing. Its products cover member management, scheduling, point-of-sale, and reporting for single-location studios to multi-site fitness chains, with recurring revenue from subscriptions and processing fees. The company is privately held, backed by private equity, and headquartered in Sherwood, Arkansas, with customers across North America and internationally.